Overview

overview

10

Static

static

10

WarpClient.exe

windows10-2004-x64

10

WarpClient.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    123s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WarpClient.exe
  • Size 405KB
  • Sample260628-pgsgrshs7p
  • SHA256 12bff457eccb4a0e1bdf00669c488f5e84868ca1cdf9421842e0addd72f78b83
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionsheetratpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 40 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies Windows Firewall 2 TTPs 10 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 10 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 20 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 42 IoCs
  • Drops file in Windows directory 30 IoCs
  • Launches sc.exe 36 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 37 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 60 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WarpClient.exe
    "C:\Users\Admin\AppData\Local\Temp\WarpClient.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies security service
    • UAC bypass
    • Windows security modification
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3432
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" enable=yes & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:6072
    • C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /S
      2⤵
        PID:916
      • C:\Windows\SYSTEM32\sc.exe
        "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
        2⤵
        • Launches sc.exe
        PID:3812
      • C:\Windows\SYSTEM32\sc.exe
        "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
        2⤵
        • Launches sc.exe
        PID:2496
      • C:\Windows\SYSTEM32\sc.exe
        "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
        2⤵
        • Launches sc.exe
        PID:4468
      • C:\Windows\SYSTEM32\mountvol.exe
        "mountvol" E: /D
        2⤵
          PID:2436
        • C:\Windows\SYSTEM32\mountvol.exe
          "mountvol" F: /S
          2⤵
            PID:5432
          • C:\Windows\SYSTEM32\mountvol.exe
            "mountvol" F: /D
            2⤵
              PID:3396
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Delete /TN "User_Feed_Synchronization-17594cc0-e678-4377-9e67-fb15920f0a67" /F
              2⤵
                PID:1108
              • C:\Windows\SYSTEM32\mountvol.exe
                "mountvol" G: /S
                2⤵
                  PID:4740
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Create /TN "User_Feed_Synchronization-17594cc0-e678-4377-9e67-fb15920f0a67" /XML "C:\Users\Admin\AppData\Local\Temp\b9fccf34-b91b-4f0a-a73d-1d9df1415833.xml" /F
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1304
                • C:\Windows\SYSTEM32\sc.exe
                  "sc" stop WinDefend
                  2⤵
                  • Launches sc.exe
                  PID:3980
                • C:\Windows\SYSTEM32\sc.exe
                  "sc" config WinDefend start= demand
                  2⤵
                  • Launches sc.exe
                  PID:1448
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_926cce9a" /F
                  2⤵
                    PID:1708
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_926cce9a" /XML "C:\Users\Admin\AppData\Local\Temp\53fbcb01-95c7-4fe8-a9c6-f01f852c7633.xml" /F
                    2⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:1416
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_1931127d" /F
                    2⤵
                      PID:3964
                    • C:\Windows\SYSTEM32\mountvol.exe
                      "mountvol" G: /D
                      2⤵
                        PID:2784
                      • C:\Windows\SYSTEM32\schtasks.exe
                        "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_1931127d" /XML "C:\Users\Admin\AppData\Local\Temp\b80bbac8-d85d-476f-a2ef-c13f772004b0.xml" /F
                        2⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:3644
                      • C:\Windows\SYSTEM32\mountvol.exe
                        "mountvol" H: /S
                        2⤵
                          PID:5308
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd" /c schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1268
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:4876
                        • C:\Windows\SYSTEM32\CMD.exe
                          "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4228
                          • C:\Windows\system32\schtasks.exe
                            schtasks /delete /F /TN "WarpClient"
                            3⤵
                              PID:2380
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4960
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                              3⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:2668
                          • C:\Windows\SYSTEM32\sc.exe
                            "sc" stop WinDefend
                            2⤵
                            • Launches sc.exe
                            PID:4896
                          • C:\Windows\SYSTEM32\sc.exe
                            "sc" config WinDefend start= demand
                            2⤵
                            • Launches sc.exe
                            PID:5080
                          • C:\Windows\SYSTEM32\mountvol.exe
                            "mountvol" H: /D
                            2⤵
                              PID:3180
                            • C:\Windows\SYSTEM32\mountvol.exe
                              "mountvol" I: /S
                              2⤵
                                PID:3228
                              • C:\Windows\SYSTEM32\mountvol.exe
                                "mountvol" I: /D
                                2⤵
                                  PID:3292
                                • C:\Windows\SYSTEM32\mountvol.exe
                                  "mountvol" J: /S
                                  2⤵
                                    PID:5964
                                  • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                    "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                    2⤵
                                    • Modifies Windows Defender DisableAntiSpyware settings
                                    • UAC bypass
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    • System policy modification
                                    PID:2500
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                      3⤵
                                        PID:4868
                                        • C:\Windows\system32\netsh.exe
                                          netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
                                          4⤵
                                          • Modifies Windows Firewall
                                          • Event Triggered Execution: Netsh Helper DLL
                                          PID:6964
                                      • C:\Windows\SYSTEM32\mountvol.exe
                                        "mountvol" E: /S
                                        3⤵
                                          PID:7052
                                        • C:\Windows\SYSTEM32\sc.exe
                                          "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                          3⤵
                                          • Launches sc.exe
                                          PID:6344
                                        • C:\Windows\SYSTEM32\sc.exe
                                          "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                          3⤵
                                          • Launches sc.exe
                                          PID:2264
                                        • C:\Windows\SYSTEM32\sc.exe
                                          "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                          3⤵
                                          • Launches sc.exe
                                          PID:4444
                                        • C:\Windows\SYSTEM32\mountvol.exe
                                          "mountvol" E: /D
                                          3⤵
                                            PID:6256
                                          • C:\Windows\SYSTEM32\mountvol.exe
                                            "mountvol" F: /S
                                            3⤵
                                              PID:6464
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_dbefe9c4" /F
                                              3⤵
                                                PID:6160
                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                "mountvol" F: /D
                                                3⤵
                                                • Enumerates connected drives
                                                PID:1520
                                              • C:\Windows\SYSTEM32\CMD.exe
                                                "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                3⤵
                                                  PID:5228
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /delete /F /TN "WarpClient"
                                                    4⤵
                                                      PID:6520
                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                    "mountvol" G: /S
                                                    3⤵
                                                      PID:6268
                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                      "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_dbefe9c4" /XML "C:\Users\Admin\AppData\Local\Temp\e3f698f2-a73f-49d2-9ce7-aabc4c5a9225.xml" /F
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:6176
                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                      "schtasks.exe" /Delete /TN "CCleanerSkipUAC_0f8b1807" /F
                                                      3⤵
                                                        PID:6628
                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                        "schtasks.exe" /Create /TN "CCleanerSkipUAC_0f8b1807" /XML "C:\Users\Admin\AppData\Local\Temp\80a770ff-b15f-472b-8d95-b85dc2722dea.xml" /F
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:6760
                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                        "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_f95a5abc" /F
                                                        3⤵
                                                          PID:6784
                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                          "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_f95a5abc" /XML "C:\Users\Admin\AppData\Local\Temp\8d361896-c348-4731-a076-8d36f378c529.xml" /F
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:7040
                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                          "mountvol" G: /D
                                                          3⤵
                                                            PID:6220
                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                            "mountvol" H: /S
                                                            3⤵
                                                              PID:7144
                                                        • C:\Users\Admin\AppData\Local\Temp\WarpClient.exe
                                                          C:\Users\Admin\AppData\Local\Temp\WarpClient.exe
                                                          1⤵
                                                          • Modifies Windows Defender DisableAntiSpyware settings
                                                          • Modifies Windows Defender TamperProtection settings
                                                          • Modifies security service
                                                          • UAC bypass
                                                          • Windows security modification
                                                          • Checks whether UAC is enabled
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          • System policy modification
                                                          PID:1092
                                                          • C:\Windows\system32\cmd.exe
                                                            "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" enable=yes & exit
                                                            2⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4268
                                                            • C:\Windows\System32\netsh.exe
                                                              netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" enable=yes
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:4780
                                                          • C:\Windows\system32\mountvol.exe
                                                            "mountvol" E: /S
                                                            2⤵
                                                              PID:3004
                                                            • C:\Windows\system32\sc.exe
                                                              "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                              2⤵
                                                              • Launches sc.exe
                                                              PID:3724
                                                            • C:\Windows\system32\sc.exe
                                                              "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                              2⤵
                                                              • Launches sc.exe
                                                              PID:5884
                                                            • C:\Windows\system32\sc.exe
                                                              "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                              2⤵
                                                              • Launches sc.exe
                                                              PID:4188
                                                            • C:\Windows\system32\schtasks.exe
                                                              "schtasks.exe" /Delete /TN "UsbCeip_92069797" /F
                                                              2⤵
                                                                PID:1148
                                                              • C:\Windows\system32\cmd.exe
                                                                "cmd" /c schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1260
                                                                • C:\Windows\System32\schtasks.exe
                                                                  schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:2580
                                                              • C:\Windows\system32\schtasks.exe
                                                                "schtasks.exe" /Create /TN "UsbCeip_92069797" /XML "C:\Windows\SystemTemp\2c261ff2-a108-4bd9-b938-8aad6120e974.xml" /F
                                                                2⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4448
                                                              • C:\Windows\system32\sc.exe
                                                                "sc" stop WinDefend
                                                                2⤵
                                                                • Launches sc.exe
                                                                PID:3448
                                                              • C:\Windows\system32\sc.exe
                                                                "sc" config WinDefend start= demand
                                                                2⤵
                                                                • Launches sc.exe
                                                                PID:4292
                                                              • C:\Windows\system32\schtasks.exe
                                                                "schtasks.exe" /Delete /TN "CCleanerSkipUAC_604616ff" /F
                                                                2⤵
                                                                  PID:1420
                                                                • C:\Windows\system32\schtasks.exe
                                                                  "schtasks.exe" /Create /TN "CCleanerSkipUAC_604616ff" /XML "C:\Windows\SystemTemp\b6f109a0-377f-4806-abaa-16da02733044.xml" /F
                                                                  2⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:4176
                                                                • C:\Windows\system32\mountvol.exe
                                                                  "mountvol" E: /D
                                                                  2⤵
                                                                    PID:2820
                                                                  • C:\Windows\system32\mountvol.exe
                                                                    "mountvol" F: /S
                                                                    2⤵
                                                                      PID:2080
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a94712d9" /F
                                                                      2⤵
                                                                        PID:1360
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a94712d9" /XML "C:\Windows\SystemTemp\bd9554ae-7cc5-4005-89ac-994f491faea0.xml" /F
                                                                        2⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:5944
                                                                      • C:\Windows\system32\CMD.exe
                                                                        "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                                                        2⤵
                                                                          PID:3876
                                                                        • C:\Windows\system32\CMD.exe
                                                                          "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                                          2⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5076
                                                                          • C:\Windows\System32\schtasks.exe
                                                                            schtasks /delete /F /TN "WarpClient"
                                                                            3⤵
                                                                              PID:944
                                                                          • C:\Windows\system32\cmd.exe
                                                                            "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                            2⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1204
                                                                            • C:\Windows\System32\schtasks.exe
                                                                              schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                              3⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:2988
                                                                          • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                            "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                            2⤵
                                                                            • Modifies Windows Defender DisableAntiSpyware settings
                                                                            • Modifies Windows Defender TamperProtection settings
                                                                            • UAC bypass
                                                                            • Executes dropped EXE
                                                                            • Windows security modification
                                                                            • Checks whether UAC is enabled
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Windows directory
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:1404
                                                                            • C:\Windows\system32\cmd.exe
                                                                              "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                                                              3⤵
                                                                                PID:3980
                                                                                • C:\Windows\System32\netsh.exe
                                                                                  netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
                                                                                  4⤵
                                                                                  • Modifies Windows Firewall
                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                  PID:836
                                                                              • C:\Windows\system32\mountvol.exe
                                                                                "mountvol" E: /S
                                                                                3⤵
                                                                                  PID:5884
                                                                                • C:\Windows\system32\sc.exe
                                                                                  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:1856
                                                                                • C:\Windows\system32\sc.exe
                                                                                  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:2036
                                                                                • C:\Windows\system32\sc.exe
                                                                                  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:5996
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  "schtasks.exe" /Delete /TN "UsbCeip_d6796cf7" /F
                                                                                  3⤵
                                                                                    PID:4316
                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                    "schtasks.exe" /Create /TN "UsbCeip_d6796cf7" /XML "C:\Windows\SystemTemp\4c789a5c-73f0-4bf6-8c60-da626321ca9c.xml" /F
                                                                                    3⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:3948
                                                                                  • C:\Windows\system32\CMD.exe
                                                                                    "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                                                    3⤵
                                                                                      PID:3992
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        schtasks /delete /F /TN "WarpClient"
                                                                                        4⤵
                                                                                          PID:3964
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                                        3⤵
                                                                                          PID:2436
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                            4⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:5944
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_eea07ad3" /F
                                                                                          3⤵
                                                                                            PID:6052
                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                            "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_eea07ad3" /XML "C:\Windows\SystemTemp\6f39d16e-18f6-4c6d-9428-d4276886fb02.xml" /F
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:4804
                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                            "mountvol" E: /D
                                                                                            3⤵
                                                                                              PID:1312
                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                              "mountvol" F: /S
                                                                                              3⤵
                                                                                                PID:1824
                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_14904325" /F
                                                                                                3⤵
                                                                                                  PID:1612
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  "schtasks.exe" /Create /TN "Intel PTT EK Recertification_14904325" /XML "C:\Windows\SystemTemp\e8206ad7-582e-4e99-8bf1-a092a8cdffe0.xml" /F
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:5528
                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                  "mountvol" F: /D
                                                                                                  3⤵
                                                                                                  • Enumerates connected drives
                                                                                                  PID:2992
                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                  "mountvol" G: /S
                                                                                                  3⤵
                                                                                                    PID:4248
                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                    "mountvol" G: /D
                                                                                                    3⤵
                                                                                                    • Enumerates connected drives
                                                                                                    PID:2640
                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                    "mountvol" H: /S
                                                                                                    3⤵
                                                                                                      PID:5944
                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                      "mountvol" H: /D
                                                                                                      3⤵
                                                                                                      • Enumerates connected drives
                                                                                                      PID:1304
                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                      "mountvol" I: /S
                                                                                                      3⤵
                                                                                                        PID:4924
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe"
                                                                                                    1⤵
                                                                                                    • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                    • UAC bypass
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Drops file in System32 directory
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • System policy modification
                                                                                                    PID:4660
                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                      "mountvol" E: /S
                                                                                                      2⤵
                                                                                                        PID:5436
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe" enable=yes & exit
                                                                                                        2⤵
                                                                                                          PID:2684
                                                                                                          • C:\Windows\System32\netsh.exe
                                                                                                            netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe" enable=yes
                                                                                                            3⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            PID:4300
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                          2⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:1016
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                          2⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:2020
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                          2⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:1572
                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                          "schtasks.exe" /Delete /TN "FamilySafetyMonitor_9f56bb4a" /F
                                                                                                          2⤵
                                                                                                            PID:3612
                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                            "schtasks.exe" /Create /TN "FamilySafetyMonitor_9f56bb4a" /XML "C:\Users\Admin\AppData\Local\Temp\2e8d7b35-5ec8-457b-9c40-69b499963816.xml" /F
                                                                                                            2⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:3644
                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                            "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_49f34bbd" /F
                                                                                                            2⤵
                                                                                                              PID:5588
                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                              "schtasks.exe" /Create /TN "Intel PTT EK Recertification_49f34bbd" /XML "C:\Users\Admin\AppData\Local\Temp\4f2d3aac-b4db-4d2e-829b-5f1734a59263.xml" /F
                                                                                                              2⤵
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:2008
                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                              "mountvol" E: /D
                                                                                                              2⤵
                                                                                                                PID:6048
                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                "mountvol" F: /S
                                                                                                                2⤵
                                                                                                                  PID:4292
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  "schtasks.exe" /Delete /TN "ProgramDataUpdater_0597e8b3" /F
                                                                                                                  2⤵
                                                                                                                    PID:3964
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:5964
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      "schtasks.exe" /Create /TN "ProgramDataUpdater_0597e8b3" /XML "C:\Users\Admin\AppData\Local\Temp\0aeee4c7-027a-43f6-9877-1b8e0857a7af.xml" /F
                                                                                                                      2⤵
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:1940
                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                      "mountvol" F: /D
                                                                                                                      2⤵
                                                                                                                      • Enumerates connected drives
                                                                                                                      PID:5952
                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                      "mountvol" G: /S
                                                                                                                      2⤵
                                                                                                                        PID:5016
                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                        "mountvol" G: /D
                                                                                                                        2⤵
                                                                                                                        • Enumerates connected drives
                                                                                                                        PID:3556
                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                        "mountvol" H: /S
                                                                                                                        2⤵
                                                                                                                          PID:5912
                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                          "mountvol" H: /D
                                                                                                                          2⤵
                                                                                                                          • Enumerates connected drives
                                                                                                                          PID:1512
                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                          "mountvol" I: /S
                                                                                                                          2⤵
                                                                                                                            PID:3888
                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                            "mountvol" I: /D
                                                                                                                            2⤵
                                                                                                                              PID:1612
                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                              "mountvol" J: /S
                                                                                                                              2⤵
                                                                                                                                PID:1168
                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                "mountvol" J: /D
                                                                                                                                2⤵
                                                                                                                                  PID:4812
                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                  "mountvol" K: /S
                                                                                                                                  2⤵
                                                                                                                                    PID:1448
                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                    "mountvol" K: /D
                                                                                                                                    2⤵
                                                                                                                                      PID:4764
                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                      "mountvol" L: /S
                                                                                                                                      2⤵
                                                                                                                                        PID:6124
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          3⤵
                                                                                                                                            PID:936
                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                          "mountvol" L: /D
                                                                                                                                          2⤵
                                                                                                                                            PID:5108
                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                            "mountvol" M: /S
                                                                                                                                            2⤵
                                                                                                                                              PID:5612
                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                              "mountvol" M: /D
                                                                                                                                              2⤵
                                                                                                                                              • Enumerates connected drives
                                                                                                                                              PID:1812
                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                              "mountvol" N: /S
                                                                                                                                              2⤵
                                                                                                                                                PID:4300
                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                "mountvol" N: /D
                                                                                                                                                2⤵
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                PID:4828
                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                "mountvol" O: /S
                                                                                                                                                2⤵
                                                                                                                                                  PID:5996
                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                  "mountvol" O: /D
                                                                                                                                                  2⤵
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  PID:4916
                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                  "mountvol" P: /S
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5208
                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                    "mountvol" P: /D
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5912
                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                      "mountvol" Q: /S
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3964
                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                        "mountvol" Q: /D
                                                                                                                                                        2⤵
                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                        PID:7140
                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                        "mountvol" R: /S
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3256
                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                          "mountvol" R: /D
                                                                                                                                                          2⤵
                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                          PID:6684
                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                          "mountvol" S: /S
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6712
                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                            "mountvol" S: /D
                                                                                                                                                            2⤵
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            PID:6656
                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                            "mountvol" T: /S
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6720
                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                              "mountvol" T: /D
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4560
                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                "mountvol" U: /S
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6560
                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                  "mountvol" U: /D
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6444
                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                    "mountvol" V: /S
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6448
                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                      "mountvol" V: /D
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6756
                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                        "mountvol" W: /S
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6772
                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                          "mountvol" W: /D
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6256
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6464
                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                              "mountvol" X: /S
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6872
                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                "mountvol" X: /D
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                PID:2532
                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                "mountvol" Y: /S
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4848
                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                  "mountvol" Y: /D
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                  PID:3632
                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                  "mountvol" E: /S
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:6352
                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                    "mountvol" E: /D
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:7092
                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                      "mountvol" F: /S
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5084
                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                        "mountvol" F: /D
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6804
                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                          "mountvol" G: /S
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5820
                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                            "mountvol" G: /D
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                            PID:1444
                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                            "mountvol" H: /S
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4956
                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                              "mountvol" H: /D
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                              PID:6180
                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                "mountvol" I: /S
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:6960
                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                    "mountvol" I: /D
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:7056
                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                      "mountvol" J: /S
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                        "mountvol" J: /D
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:7164
                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                          "mountvol" K: /S
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                              "mountvol" K: /D
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                              "mountvol" L: /S
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                "mountvol" L: /D
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                PID:6636
                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                "mountvol" M: /S
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                  "mountvol" M: /D
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  PID:2596
                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                  "mountvol" N: /S
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                    "mountvol" N: /D
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:5408
                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                      "mountvol" O: /S
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4752
                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                        "mountvol" O: /D
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                          "mountvol" P: /S
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6840
                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                            "mountvol" P: /D
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                            PID:6848
                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                              "mountvol" Q: /S
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                "mountvol" Q: /D
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6864
                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:6764
                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                    "mountvol" R: /S
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                      "mountvol" R: /D
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                      PID:6732
                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                      "mountvol" S: /S
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5532
                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                        "mountvol" S: /D
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4340
                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                          "mountvol" T: /S
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                            "mountvol" T: /D
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1444
                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                              "mountvol" U: /S
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:6872
                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                  "mountvol" U: /D
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                  PID:4132
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                    "mountvol" V: /S
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:6716
                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:6924
                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                        "mountvol" V: /D
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        PID:6828
                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                        "mountvol" W: /S
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                          "mountvol" W: /D
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                            "mountvol" X: /S
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                              "mountvol" X: /D
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                              PID:1480
                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                              "mountvol" Y: /S
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2688
                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                "mountvol" Y: /D
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:6844
                                                                                                                                                                                                                                                              • C:\Windows\System32\BootFiles\BootExecutor.exe
                                                                                                                                                                                                                                                                C:\Windows\System32\BootFiles\BootExecutor.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                  • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                    PID:1116
                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                  "mountvol" E: /S
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1788
                                                                                                                                                                                                                                                                  • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:5156
                                                                                                                                                                                                                                                                  • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                  • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                    "mountvol" E: /D
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                    "mountvol" F: /S
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                      "mountvol" F: /D
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                      "mountvol" G: /S
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1800
                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                        "mountvol" G: /D
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                        "mountvol" H: /S
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                          "mountvol" H: /D
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3580
                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                            "mountvol" I: /S
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:3700
                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                              "mountvol" I: /D
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5628
                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                "mountvol" J: /S
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                  "mountvol" J: /D
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                  "mountvol" K: /S
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:4984
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                    "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_1a223d84" /F
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                      "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_1a223d84" /XML "C:\Users\Admin\AppData\Local\Temp\3d1ad5a5-5aee-430d-9e38-3803dcceb7c9.xml" /F
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                      "mountvol" K: /D
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                      PID:3252
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                      "schtasks.exe" /Delete /TN "CCleanerSkipUAC_ca64dcbb" /F
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                        "mountvol" L: /S
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                          "schtasks.exe" /Create /TN "CCleanerSkipUAC_ca64dcbb" /XML "C:\Users\Admin\AppData\Local\Temp\0502e076-6c91-4821-8947-89939ccccad8.xml" /F
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                          PID:4924
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                            "schtasks.exe" /Delete /TN "FamilySafetyMonitor_ee7c16cb" /F
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:5812
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                              "schtasks.exe" /Create /TN "FamilySafetyMonitor_ee7c16cb" /XML "C:\Users\Admin\AppData\Local\Temp\b1f1d7f9-28d3-47f2-b513-444eab31077d.xml" /F
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                              "mountvol" L: /D
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                              PID:3716
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                              "mountvol" M: /S
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                "mountvol" M: /D
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                PID:5964
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                "mountvol" N: /S
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                  "mountvol" N: /D
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                  "mountvol" O: /S
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                    "mountvol" O: /D
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                    "mountvol" P: /S
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                      "mountvol" P: /D
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:5620
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                        "mountvol" Q: /S
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                          "mountvol" Q: /D
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                            "mountvol" R: /S
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                              "mountvol" R: /D
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                              "mountvol" S: /S
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:4904
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                "mountvol" S: /D
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3248
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                  "mountvol" T: /S
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:4448
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                    "mountvol" T: /D
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                      "mountvol" U: /S
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:6892
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                        "mountvol" U: /D
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                        "mountvol" V: /S
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                          "mountvol" V: /D
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                            "mountvol" W: /S
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                              "mountvol" W: /D
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:6408
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                "mountvol" X: /S
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:6104
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                  "mountvol" X: /D
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                  "mountvol" Y: /S
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:6468
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                    "mountvol" Y: /D
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:6500
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                      "mountvol" E: /S
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:6596
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                        "mountvol" E: /D
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:1920
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                          "mountvol" F: /S
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:6380
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                            "mountvol" F: /D
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:6760
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                              "mountvol" G: /S
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:6808
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                "mountvol" G: /D
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                  "mountvol" H: /S
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                    "mountvol" H: /D
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6864
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                      "mountvol" I: /S
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6788
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                        "mountvol" I: /D
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                        "mountvol" J: /S
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6784
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                            "mountvol" J: /D
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5676
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                              "mountvol" K: /S
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6512
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                "mountvol" K: /D
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                  "mountvol" L: /S
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6640
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                    "mountvol" L: /D
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                      "mountvol" M: /S
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6520
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                          "mountvol" M: /D
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6852
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                            "mountvol" N: /S
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5984
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                              "mountvol" N: /D
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:972
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6644
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" O: /S
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6780
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" O: /D
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:124
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" P: /S
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" P: /D
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" Q: /S
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7112
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" Q: /D
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7140
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" R: /S
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" R: /D
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6632
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6344
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" S: /S
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" S: /D
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" T: /S
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" T: /D
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" U: /S
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6248
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6220
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6332
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6516
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6796
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "schtasks.exe" /Delete /TN "CCleanerSkipUAC_127dc9a1" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks.exe" /Create /TN "CCleanerSkipUAC_127dc9a1" /XML "C:\Users\Admin\AppData\Local\Temp\c5fc145a-b5d4-44ad-9ca1-d7cc71166e72.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\CMD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /delete /F /TN "WarpClient"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "schtasks.exe" /Delete /TN "UsbCeip_a7000433" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks.exe" /Create /TN "UsbCeip_a7000433" /XML "C:\Users\Admin\AppData\Local\Temp\850d17b5-0f0d-4944-b45f-5d2a55938b68.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_0fd8489e" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_0fd8489e" /XML "C:\Users\Admin\AppData\Local\Temp\2eeac72e-7672-4c4c-881a-953e2e7498aa.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\BootFiles\BootExecutor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\BootFiles\BootExecutor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe" enable=yes & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe" enable=yes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WmiPrvSE.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4d66235e" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\CMD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /delete /F /TN "WarpClient"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4d66235e" /XML "C:\Users\Admin\AppData\Local\Temp\7dadcc3c-9c20-4451-9e08-9e8c027ef54a.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2b9b1ec7" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2b9b1ec7" /XML "C:\Users\Admin\AppData\Local\Temp\583ab89a-4e08-4e23-af12-ca3d88f31f09.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\CMD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /delete /F /TN "WarpClient"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "schtasks.exe" /Delete /TN "User_Feed_Synchronization-ed3ae9fb-06ff-4da8-8e23-a96c8ffeda09" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "schtasks.exe" /Create /TN "User_Feed_Synchronization-ed3ae9fb-06ff-4da8-8e23-a96c8ffeda09" /XML "C:\Users\Admin\AppData\Local\Temp\ae7e054d-9b8f-4620-9e2b-f81c5866b804.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_444c16be" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_444c16be" /XML "C:\Users\Admin\AppData\Local\Temp\e642fea9-e484-41fa-89e2-e2b7574110df.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" P: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" P: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" Q: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" Q: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" R: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" R: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" S: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" S: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" T: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" T: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" U: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" P: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" P: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" Q: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" Q: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" R: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" R: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" S: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" S: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" T: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" T: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" U: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "mountvol" X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "mountvol" X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "mountvol" Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Windows Defender TamperProtection settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "schtasks.exe" /Delete /TN "User_Feed_Synchronization-af970263-d6b7-4621-8cf5-e764a402deb2" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\CMD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "CMD" /c schtasks /delete /F /TN "WarpClient" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /delete /F /TN "WarpClient"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "schtasks.exe" /Create /TN "User_Feed_Synchronization-af970263-d6b7-4621-8cf5-e764a402deb2" /XML "C:\Windows\SystemTemp\d10b17d5-b0a2-4a12-9b22-7d503d27b4be.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd" /c schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /create /f /sc onlogon /tn "WarpClient" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c1f48ff9" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c1f48ff9" /XML "C:\Windows\SystemTemp\372c136d-ccbb-4226-b9f1-22590db5099e.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_baa0a1a2" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_baa0a1a2" /XML "C:\Windows\SystemTemp\f6eb44a7-25ba-471f-81f7-ced84aca4059.xml" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "mountvol" F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "mountvol" F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "mountvol" G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "mountvol" H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "mountvol" H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:508

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1489

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 599B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      0502e076-6c91-4821-8947-89939ccccad8.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\0502e076-6c91-4821-8947-89939ccccad8.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 452311d8bac64343869f8582cff657a377137d699b93bbb19dbf1108b6e0aaae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      0aeee4c7-027a-43f6-9877-1b8e0857a7af.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\0aeee4c7-027a-43f6-9877-1b8e0857a7af.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fb05666946ed3584796bd169c3fb725a2a424b1d62bb37f12434147d7b6da255
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2e8d7b35-5ec8-457b-9c40-69b499963816.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2e8d7b35-5ec8-457b-9c40-69b499963816.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e82a766915c64acd2939d4e243297a8b3ba99c20bc307ddefe46e1fb443fb0c5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2eeac72e-7672-4c4c-881a-953e2e7498aa.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2eeac72e-7672-4c4c-881a-953e2e7498aa.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a9fd620eb027eae1f0d665f3b487ccbd25fe40d4adeabaa6004d69e9c3cb5c7a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3d1ad5a5-5aee-430d-9e38-3803dcceb7c9.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3d1ad5a5-5aee-430d-9e38-3803dcceb7c9.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c7a06358aa0b61c92310c7cf5878e3f06dee899bb03fcfcd48091708dca42501
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4f2d3aac-b4db-4d2e-829b-5f1734a59263.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4f2d3aac-b4db-4d2e-829b-5f1734a59263.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 833523028f95e25fb43607066edbbb3cfd31d3ff20452ebb69e87436c01515d3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      53fbcb01-95c7-4fe8-a9c6-f01f852c7633.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\53fbcb01-95c7-4fe8-a9c6-f01f852c7633.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7d498408cf5f90086cd99e4e019a1df02b4c113f19bffde4b2a4af1b40a92276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      583ab89a-4e08-4e23-af12-ca3d88f31f09.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\583ab89a-4e08-4e23-af12-ca3d88f31f09.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d0a33d72f28b10666e7bcfcee539a3bb07f705e6a2866f980092ca622c7226e7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7dadcc3c-9c20-4451-9e08-9e8c027ef54a.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7dadcc3c-9c20-4451-9e08-9e8c027ef54a.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a7ad17e6fcf6c1bc1bf5a47ce66d53b2e0c4d7ad407f937cf3fd4fed0c0dc7d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      80a770ff-b15f-472b-8d95-b85dc2722dea.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\80a770ff-b15f-472b-8d95-b85dc2722dea.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 980a9ca7bf74036a02fe28705928861f8b3d51606ae07a8f3931cc22ee36cd75
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      850d17b5-0f0d-4944-b45f-5d2a55938b68.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\850d17b5-0f0d-4944-b45f-5d2a55938b68.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cb4543e9a129d4cf7a5c70317a91ad712395d1ebc656614263f2945bc0b63c9d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8d361896-c348-4731-a076-8d36f378c529.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\8d361896-c348-4731-a076-8d36f378c529.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5ee63e2cdbaee4e43283bc1dc05a4dd1d0cec713302cbb62146fbc3d457a5af5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ae7e054d-9b8f-4620-9e2b-f81c5866b804.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ae7e054d-9b8f-4620-9e2b-f81c5866b804.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7b398a088eda1d4339d319916ef1c05cdfdaa8e3e0a6b9390c2e85e67d5e67e4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      b1f1d7f9-28d3-47f2-b513-444eab31077d.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b1f1d7f9-28d3-47f2-b513-444eab31077d.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 996ab4749fa32fd21f876ec95261843c6ae038324c045d47120e7115e6c34bf1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      b80bbac8-d85d-476f-a2ef-c13f772004b0.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b80bbac8-d85d-476f-a2ef-c13f772004b0.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9d64bb5127cbf3dc63c662507111988decb7ef88211fe889d4ee8aea55b633aa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      b9fccf34-b91b-4f0a-a73d-1d9df1415833.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b9fccf34-b91b-4f0a-a73d-1d9df1415833.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4e685b8549ade303120e5c6b6427dba54d81578604698d72b879613073e20344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      c5fc145a-b5d4-44ad-9ca1-d7cc71166e72.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5fc145a-b5d4-44ad-9ca1-d7cc71166e72.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 60e5b08b01c21ce8d6c4008bf9bb56a7d541c82a636e213e6e6c1ba790ab1309
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      e3f698f2-a73f-49d2-9ce7-aabc4c5a9225.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e3f698f2-a73f-49d2-9ce7-aabc4c5a9225.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 599c93fa57f1eb94a389699aae8aba1b523bd3b4273f3e890a614a7fd3356d15
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      e642fea9-e484-41fa-89e2-e2b7574110df.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\e642fea9-e484-41fa-89e2-e2b7574110df.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b6ba88a2adf19b16c0a735ce3cf410a914dbe882ddbbd9f79f578a91d81c9e4f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      BootExecutor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\System32\BootFiles\BootExecutor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 405KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 12bff457eccb4a0e1bdf00669c488f5e84868ca1cdf9421842e0addd72f78b83
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2c261ff2-a108-4bd9-b938-8aad6120e974.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\2c261ff2-a108-4bd9-b938-8aad6120e974.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 67c8f710f291b8e3831062d78a1ffa9a3f843d82c3f8af0b9a96bdf8c9afc04b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      372c136d-ccbb-4226-b9f1-22590db5099e.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\372c136d-ccbb-4226-b9f1-22590db5099e.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5259805080a519c76351f429cff5921354cf7aba138af55f47ccf49ba47f8ccc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4c789a5c-73f0-4bf6-8c60-da626321ca9c.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\4c789a5c-73f0-4bf6-8c60-da626321ca9c.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6f0cbcd2d6e700fe249a50b2208b048e83a79e05117bedb11bfd4761077a5ae0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6f39d16e-18f6-4c6d-9428-d4276886fb02.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\6f39d16e-18f6-4c6d-9428-d4276886fb02.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b27e22fa94fe98b1156b751bd094f54a4ff28e39718fa0c3c6b0027b32de067b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      b6f109a0-377f-4806-abaa-16da02733044.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\b6f109a0-377f-4806-abaa-16da02733044.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 35844b13f7c69a9082c9ec488aa193162830a0167f0f77c30ba4ba0c9754bf4e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      bd9554ae-7cc5-4005-89ac-994f491faea0.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\bd9554ae-7cc5-4005-89ac-994f491faea0.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c514e3243078b0114ebce9faf1c7340d6fcf21d3b2967dffa0d2244f4c0b0b96
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      d10b17d5-b0a2-4a12-9b22-7d503d27b4be.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\d10b17d5-b0a2-4a12-9b22-7d503d27b4be.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 889a449b0b68ba761c2641034789a8c1836ee67ec3d384b0abd08f05bdbbf59f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      e8206ad7-582e-4e99-8bf1-a092a8cdffe0.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\e8206ad7-582e-4e99-8bf1-a092a8cdffe0.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 636674efd44182817d0fcbb96ae01e85bbb5e364e8b5432ad693390c59fe7262
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      f6eb44a7-25ba-471f-81f7-ced84aca4059.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SystemTemp\f6eb44a7-25ba-471f-81f7-ced84aca4059.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 616adb1280246aaeaa24df3cf1fe20f465632ca2df392031190c23a9a4f6d996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3108-298-0x00000122F5000000-0x00000122F5691000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3372-136-0x0000019B01A20000-0x0000019B01A40000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3372-107-0x0000019B001E0000-0x0000019B002E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3372-145-0x0000019B01C60000-0x0000019B01C80000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3372-137-0x0000019B01E60000-0x0000019B01F60000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3372-170-0x0000019B146E0000-0x0000019B14700000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-7-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-8-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-1-0x00007FFCDA8DF000-0x00007FFCDA8E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-2-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-70-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-3-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-4-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-0-0x00000206298F0000-0x000002062995A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-5-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-6-0x00007FFCDA750000-0x00007FFCDB0F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3856-104-0x00007FFCD6E00000-0x00007FFCD705E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3856-286-0x00007FFCD6E00000-0x00007FFCD705E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3856-91-0x00007FFCAC5A0000-0x00007FFCAC5B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-89-0x000001F2D4760000-0x000001F2D4761000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-34-0x000001F2BA210000-0x000001F2BA211000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-38-0x000001F2BA590000-0x000001F2BA591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-296-0x000001F2D4790000-0x000001F2D4791000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-287-0x000001F2D4780000-0x000001F2D4781000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-59-0x000001F2BA5A0000-0x000001F2BA5A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-259-0x000001F2D4770000-0x000001F2D4771000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-65-0x000001F2BA760000-0x000001F2BA761000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-97-0x00007FFCD6E00000-0x00007FFCD705E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-62-0x000001F2BA5B0000-0x000001F2BA5B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-67-0x000001F2BA770000-0x000001F2BA771000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4660-318-0x00007FFCD6E00000-0x00007FFCD705E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download