xmrig | df441398ca80b640ec4499b43f5846583b07c2b18d2f126a636e440e41218667

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aact.exe
Size 5.1MB
Sample260729-am3glach66
SHA256 df441398ca80b640ec4499b43f5846583b07c2b18d2f126a636e440e41218667
MD5 cb16475f4bc617dd9abb725fa3abb548
SHA1 b93ee45ce0fc266ac7016b29ccd25464efc0438a
SHA512 643d9f0095312c81b87cdc1db4b1821a45230846a205f1b92d94b5fa619cf2836d0899e19d0f83cb7c64ef0f2c0a3e2235fffca6dc7634efe5e6db105473cf7b
SSDEEP 98304:V0+SBxqulcUJ6V6Zof21O6M7lGT4AOQfu5Sgu9hr1BevK:V0+SBxdOBf21O6n02gubr1+K
TLSH
T1F14612D266BC0CA9D9D5B27FF7410235B3E1680DC623865B1E739779CA132B06B2DA31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c5bc-40.dat	family_xmrig
behavioral2/files/0x000d00000001c5bc-40.dat	xmrig

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe\Debugger = "rundll32.exe SECOPatcher.dll,PatcherMain"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe	reg.exe

Modifies Windows Firewall 2 TTPs 21 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
996	netsh.exe
4356	netsh.exe
1160	netsh.exe
2384	netsh.exe
1212	netsh.exe
552	netsh.exe
4596	netsh.exe
5400	netsh.exe
4608	netsh.exe
3552	netsh.exe
4940	netsh.exe
2104	netsh.exe
1352	netsh.exe
2612	netsh.exe
3748	netsh.exe
2920	netsh.exe
2100	netsh.exe
4220	netsh.exe
4536	netsh.exe
2544	netsh.exe
4204	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
6004	AAct_x64.exe
1232	AAct_x64.exe
4124	KMSSS.exe

Loads dropped DLL 2 IoCs

pid	Process
3744	rundll32.exe
2456	SppExtComObj.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3896	icacls.exe
5656	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe\Debugger	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\SECOPatcher.dll	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
3876	cscript.exe
252	cscript.exe
4320	cscript.exe
3536	cscript.exe
2904	WScript.exe
5500	cscript.exe
5948	cscript.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c5bb-23.dat	upx
behavioral2/memory/6004-24-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/6004-38-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-43-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-42-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-45-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-46-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-47-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-48-0x0000000140000000-0x0000000140346000-memory.dmp	upx
behavioral2/memory/1232-49-0x0000000140000000-0x0000000140346000-memory.dmp	upx

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AAct_Tools\	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools	Aact.exe
File created	C:\Windows\AAct_Tools\activator.xml	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\AAct_x64.exe	Aact.exe
File created	C:\Windows\AAct_Tools\start.vbs	Aact.exe
File created	C:\Windows\AAct_Tools\AAct_files\SECOPatcher.dll	AAct_x64.exe
File created	C:\Windows\AAct_Tools\AAct_files\KMSSS.exe	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\AAct_files\SECOPatcher.dll	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\AAct_files\	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\AAct.xml	Aact.exe
File created	C:\Windows\AAct_Tools\__tmp_rar_sfx_access_check_240715328	Aact.exe
File created	C:\Windows\AAct_Tools\act.exe	Aact.exe
File created	C:\Windows\AAct_Tools\WinRing0x64.sys	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\WinRing0x64.sys	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\start.vbs	Aact.exe
File created	C:\Windows\AAct_Tools\setup.cmd	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\AAct.ini	AAct_x64.exe
File created	C:\Windows\AAct_Tools\AAct_x64.exe	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\setup.cmd	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\AAct_files\KMSSS.exe	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\AAct_x64.exe	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\WinRing0x64.sys	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\activator.xml	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\act.exe	Aact.exe
File created	C:\Windows\AAct_Tools\AAct.xml	Aact.exe
File opened for modification	C:\Windows\AAct_Tools\"C:\Windows\System32\SECOPatcher.dll"	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\AAct_files\KMSSS.exe	AAct_x64.exe
File opened for modification	C:\Windows\AAct_Tools\act.exe	AAct_x64.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2108	sc.exe
3532	sc.exe
1500	sc.exe
3504	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 63 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe
2396	cmd.exe
5740	cmd.exe
4776	cmd.exe
2112	cmd.exe
624	cmd.exe
4100	cmd.exe
5996	cmd.exe
3964	cmd.exe
5280	cmd.exe
4768	cmd.exe
1276	cmd.exe
1504	cmd.exe
5508	cmd.exe
5008	cmd.exe
5856	cmd.exe
1788	cmd.exe
5056	cmd.exe
1540	cmd.exe
3716	cmd.exe
3904	cmd.exe
796	cmd.exe
1384	cmd.exe
5716	cmd.exe
5788	cmd.exe
5648	cmd.exe
5664	cmd.exe
3332	cmd.exe
1148	cmd.exe
4296	cmd.exe
980	cmd.exe
3520	cmd.exe
5780	cmd.exe
3316	cmd.exe
3468	cmd.exe
3516	cmd.exe
120	cmd.exe
3304	cmd.exe
1004	cmd.exe
5676	cmd.exe
4736	cmd.exe
1292	cmd.exe
3132	cmd.exe
1164	cmd.exe
3892	cmd.exe
4568	cmd.exe
3536	cmd.exe
3092	cmd.exe
5628	cmd.exe
5984	cmd.exe
2036	cmd.exe
4608	cmd.exe
1772	cmd.exe
5052	cmd.exe
2348	cmd.exe
1756	cmd.exe
4372	cmd.exe
2392	cmd.exe
616	cmd.exe
4252	cmd.exe
552	cmd.exe
5132	cmd.exe
3636	cmd.exe
2844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSSS.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3316	timeout.exe
2792	timeout.exe

Kills process with taskkill 24 IoCs

defense_evasion

pid	Process
1376	taskkill.exe
4868	taskkill.exe
3236	taskkill.exe
4464	taskkill.exe
5800	taskkill.exe
5888	taskkill.exe
4192	taskkill.exe
6056	taskkill.exe
5980	taskkill.exe
4876	taskkill.exe
4088	taskkill.exe
5400	taskkill.exe
4972	taskkill.exe
4376	taskkill.exe
3536	taskkill.exe
1384	taskkill.exe
4152	taskkill.exe
2528	taskkill.exe
672	taskkill.exe
4296	taskkill.exe
3416	taskkill.exe
200	taskkill.exe
5624	taskkill.exe
1932	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\cscript.exe	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\cscript.exe\VBScriptSetScriptStateStarted = "240723312"	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\cscript.exe	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	Aact.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AAct_Tools\"C:\Windows\System32\SECOPatcher.dll"	AAct_x64.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe
5900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6004	AAct_x64.exe
6004	AAct_x64.exe
6004	AAct_x64.exe
6004	AAct_x64.exe
6004	AAct_x64.exe
6004	AAct_x64.exe
4200	WMIC.exe
4200	WMIC.exe
4200	WMIC.exe
4200	WMIC.exe
1460	WMIC.exe
1460	WMIC.exe
1460	WMIC.exe
1460	WMIC.exe
5732	WMIC.exe
5732	WMIC.exe
5732	WMIC.exe
5732	WMIC.exe
6004	AAct_x64.exe
6004	AAct_x64.exe
2036	WMIC.exe
2036	WMIC.exe
2036	WMIC.exe
2036	WMIC.exe
3336	WMIC.exe
3336	WMIC.exe
3336	WMIC.exe
3336	WMIC.exe
3768	WMIC.exe
3768	WMIC.exe
3768	WMIC.exe
3768	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
2060	WMIC.exe
2060	WMIC.exe
2060	WMIC.exe
2060	WMIC.exe
1808	WMIC.exe
1808	WMIC.exe
1808	WMIC.exe
1808	WMIC.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
1232	AAct_x64.exe
1232	AAct_x64.exe
3744	rundll32.exe
3744	rundll32.exe
1232	AAct_x64.exe
1232	AAct_x64.exe
1232	AAct_x64.exe
1232	AAct_x64.exe
3904	WMIC.exe
3904	WMIC.exe
3904	WMIC.exe
3904	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeAssignPrimaryTokenPrivilege	4200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4200	WMIC.exe
Token: SeSecurityPrivilege	4200	WMIC.exe
Token: SeTakeOwnershipPrivilege	4200	WMIC.exe
Token: SeLoadDriverPrivilege	4200	WMIC.exe
Token: SeSystemtimePrivilege	4200	WMIC.exe
Token: SeBackupPrivilege	4200	WMIC.exe
Token: SeRestorePrivilege	4200	WMIC.exe
Token: SeShutdownPrivilege	4200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4200	WMIC.exe
Token: SeUndockPrivilege	4200	WMIC.exe
Token: SeManageVolumePrivilege	4200	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4200	WMIC.exe
Token: SeSecurityPrivilege	4200	WMIC.exe
Token: SeTakeOwnershipPrivilege	4200	WMIC.exe
Token: SeLoadDriverPrivilege	4200	WMIC.exe
Token: SeSystemtimePrivilege	4200	WMIC.exe
Token: SeBackupPrivilege	4200	WMIC.exe
Token: SeRestorePrivilege	4200	WMIC.exe
Token: SeShutdownPrivilege	4200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4200	WMIC.exe
Token: SeUndockPrivilege	4200	WMIC.exe
Token: SeManageVolumePrivilege	4200	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1460	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1460	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5732	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5732	WMIC.exe
Token: SeSecurityPrivilege	5732	WMIC.exe
Token: SeTakeOwnershipPrivilege	5732	WMIC.exe
Token: SeLoadDriverPrivilege	5732	WMIC.exe
Token: SeSystemtimePrivilege	5732	WMIC.exe
Token: SeBackupPrivilege	5732	WMIC.exe
Token: SeRestorePrivilege	5732	WMIC.exe
Token: SeShutdownPrivilege	5732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5732	WMIC.exe
Token: SeUndockPrivilege	5732	WMIC.exe
Token: SeManageVolumePrivilege	5732	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5732	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4876	4196	Aact.exe	89
PID 4196 wrote to memory of 1376	4196	Aact.exe	92
PID 4196 wrote to memory of 2904	4196	Aact.exe	94
PID 2904 wrote to memory of 624	2904	WScript.exe	95
PID 624 wrote to memory of 4436	624	cmd.exe	97
PID 624 wrote to memory of 4256	624	cmd.exe	98
PID 624 wrote to memory of 3316	624	cmd.exe	99
PID 624 wrote to memory of 4220	624	cmd.exe	100
PID 624 wrote to memory of 5900	624	cmd.exe	101
PID 624 wrote to memory of 2792	624	cmd.exe	102
PID 6004 wrote to memory of 1320	6004	AAct_x64.exe	104
PID 1320 wrote to memory of 2108	1320	cmd.exe	106
PID 6004 wrote to memory of 364	6004	AAct_x64.exe	107
PID 364 wrote to memory of 2528	364	cmd.exe	109
PID 6004 wrote to memory of 4512	6004	AAct_x64.exe	110
PID 4512 wrote to memory of 4200	4512	cmd.exe	112
PID 6004 wrote to memory of 2512	6004	AAct_x64.exe	113
PID 2512 wrote to memory of 1680	2512	cmd.exe	116
PID 6004 wrote to memory of 6012	6004	AAct_x64.exe	117
PID 6012 wrote to memory of 5308	6012	cmd.exe	119
PID 6004 wrote to memory of 1772	6004	AAct_x64.exe	120
PID 1772 wrote to memory of 996	1772	cmd.exe	123
PID 6004 wrote to memory of 3100	6004	AAct_x64.exe	122
PID 3100 wrote to memory of 1460	3100	cmd.exe	125
PID 6004 wrote to memory of 5952	6004	AAct_x64.exe	126
PID 5952 wrote to memory of 5732	5952	cmd.exe	128
PID 6004 wrote to memory of 5700	6004	AAct_x64.exe	129
PID 5700 wrote to memory of 4088	5700	cmd.exe	209
PID 6004 wrote to memory of 3124	6004	AAct_x64.exe	132
PID 6004 wrote to memory of 4976	6004	AAct_x64.exe	133
PID 4976 wrote to memory of 4400	4976	cmd.exe	136
PID 3124 wrote to memory of 2036	3124	cmd.exe	137
PID 6004 wrote to memory of 1060	6004	AAct_x64.exe	138
PID 1060 wrote to memory of 3896	1060	cmd.exe	140
PID 6004 wrote to memory of 1612	6004	AAct_x64.exe	141
PID 6004 wrote to memory of 2264	6004	AAct_x64.exe	143
PID 2264 wrote to memory of 5656	2264	cmd.exe	145
PID 624 wrote to memory of 1232	624	cmd.exe	146
PID 624 wrote to memory of 3148	624	cmd.exe	149
PID 1232 wrote to memory of 5628	1232	AAct_x64.exe	150
PID 1232 wrote to memory of 4836	1232	AAct_x64.exe	152
PID 5628 wrote to memory of 3336	5628	cmd.exe	154
PID 6004 wrote to memory of 3092	6004	AAct_x64.exe	147
PID 3092 wrote to memory of 3768	3092	cmd.exe	156
PID 1232 wrote to memory of 1660	1232	AAct_x64.exe	157
PID 1660 wrote to memory of 5472	1660	cmd.exe	159
PID 6004 wrote to memory of 6088	6004	AAct_x64.exe	148
PID 6088 wrote to memory of 5508	6088	cmd.exe	161
PID 1232 wrote to memory of 4780	1232	AAct_x64.exe	162
PID 6004 wrote to memory of 4872	6004	AAct_x64.exe	164
PID 4780 wrote to memory of 5160	4780	cmd.exe	166
PID 4872 wrote to memory of 4356	4872	cmd.exe	167
PID 1232 wrote to memory of 1148	1232	AAct_x64.exe	168
PID 6004 wrote to memory of 4124	6004	AAct_x64.exe	170
PID 1148 wrote to memory of 2060	1148	cmd.exe	171
PID 1232 wrote to memory of 5296	1232	AAct_x64.exe	173
PID 5296 wrote to memory of 1808	5296	cmd.exe	175
PID 6004 wrote to memory of 5868	6004	AAct_x64.exe	176
PID 5868 wrote to memory of 5500	5868	cmd.exe	178
PID 6004 wrote to memory of 4120	6004	AAct_x64.exe	180
PID 4120 wrote to memory of 5948	4120	cmd.exe	182
PID 6004 wrote to memory of 2780	6004	AAct_x64.exe	183
PID 2780 wrote to memory of 3876	2780	cmd.exe	185
PID 6004 wrote to memory of 5716	6004	AAct_x64.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Aact.exe
"C:\Users\Admin\AppData\Local\Temp\Aact.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /im act.exe /f /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /im AAct_x64.exe /f /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\AAct_Tools\start.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\AAct_Tools\setup.cmd" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "\AAct" /f
      4⤵
      PID:4436
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "\Microsoft\Windows\AppID\activator" /f
      4⤵
      PID:4256
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:3316
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /xml "C:\Windows\AAct_Tools\AAct.xml" /tn "\AAct"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4220
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /xml "C:\Windows\AAct_Tools\activator.xml" /tn "\Microsoft\Windows\AppID\activator"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5900
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2792
  - - C:\Windows\AAct_Tools\AAct_x64.exe
      C:\Windows\AAct_Tools\AAct_x64.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5628
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3336
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ver.exe
        5⤵
        
        PID:4836
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1660
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5160
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1148
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2060
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files\KMSSS.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5296
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files\KMSSS.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1808
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:3548
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:4648
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:984
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4688
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM KMSSS.exe
        5⤵
        
        PID:4628
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM KMSSS.exe
        6⤵
        Kills process with taskkill
        
        PID:5400
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc.exe stop sppsvc >nul 2>&1
        5⤵
        
        PID:3760
      - C:\Windows\System32\sc.exe
        
        sc.exe stop sppsvc
        6⤵
        Launches sc.exe
        
        PID:3532
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:2296
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:672
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:1332
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        Indicator Removal: Clear Persistence
        
        PID:2968
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:2648
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        Indicator Removal: Clear Persistence
        
        PID:2792
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c del "C:\Windows\System32\SECOPatcher.dll" /F /Q
        5⤵
        Executes a command shell one-liner
        
        PID:4100
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:4292
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2104
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:5936
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3904
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:752
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:4968
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:4252
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4152
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:3012
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:2980
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        Executes a command shell one-liner
        
        PID:1164
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:2704
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:3316
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:5132
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc.exe stop sppsvc >nul 2>&1
        5⤵
        Executes a command shell one-liner
        
        PID:1260
      - C:\Windows\System32\sc.exe
        
        sc.exe stop sppsvc
        6⤵
        Launches sc.exe
        
        PID:1500
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:4828
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4464
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        Executes a command shell one-liner
        
        PID:5788
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2836
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:2568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:5672
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:1568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        Executes a command shell one-liner
        
        PID:5052
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5400
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:2456
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5596
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:1168
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:4844
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:3468
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:3364
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:3908
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2792
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:3712
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:1508
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:3312
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:2940
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4340
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        Executes a command shell one-liner
        
        PID:5984
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4296
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        Executes a command shell one-liner
        
        PID:5996
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3000
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:3720
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4988
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:2560
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1160
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:1152
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5956
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:960
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:4960
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:2228
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:1468
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:5564
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:4852
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:2568
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:1568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:5648
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4164
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:1888
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4868
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        Executes a command shell one-liner
        
        PID:1540
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:1692
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:6064
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:5580
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:4648
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1352
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:6048
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:3008
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:3440
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3360
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:5576
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5456
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        Executes a command shell one-liner
        
        PID:5664
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:4224
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        Executes a command shell one-liner
        
        PID:4768
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:4408
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:3476
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:1652
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        Executes a command shell one-liner
        
        PID:3516
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4972
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:5688
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:2040
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:2500
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:2432
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:2528
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2544
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:3964
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2404
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:3348
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:4584
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:1276
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4244
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:2620
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:1144
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
        5⤵
        
        PID:3452
      - C:\Windows\System32\cscript.exe
        
        cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3536
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        Executes a command shell one-liner
        
        PID:4296
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:4568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:5912
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4140
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc.exe stop sppsvc >nul 2>&1
        5⤵
        
        PID:4408
      - C:\Windows\System32\sc.exe
        
        sc.exe stop sppsvc
        6⤵
        Launches sc.exe
        
        PID:3504
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c net.exe stop sppsvc /y
        5⤵
        
        PID:1652
      - C:\Windows\System32\net.exe
        
        net.exe stop sppsvc /y
        6⤵
        
        PID:2704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        7⤵
        
        PID:3976
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:1564
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4376
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        Executes a command shell one-liner
        
        PID:796
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3020
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:2888
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:5072
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        Executes a command shell one-liner
        
        PID:2844
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4608
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:2328
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4464
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:5068
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:5924
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:4088
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2168
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        Executes a command shell one-liner
        
        PID:2036
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:4784
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        Executes a command shell one-liner
        
        PID:4776
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:2396
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:1868
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:5328
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:3364
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:3536
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:1484
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3332
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        Executes a command shell one-liner
        
        PID:5056
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:3340
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:2804
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2384
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:2112
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:1412
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:5676
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:4960
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:1796
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:1476
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:5656
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:3448
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        Executes a command shell one-liner
        
        PID:2348
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:2404
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:4868
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4584
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        Executes a command shell one-liner
        
        PID:4736
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:5800
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:4724
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:1948
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        Executes a command shell one-liner
        
        PID:1504
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:5888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:4600
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1212
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:4264
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:760
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:3640
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:1244
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:5508
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:3504
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:4228
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:4376
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:4208
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:2432
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:1788
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        Executes a command shell one-liner
        
        PID:120
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:1384
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        Executes a command shell one-liner
        
        PID:3716
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:5828
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:4156
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:3960
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:4200
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3552
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:1292
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:1144
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:1612
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:5888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:980
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5504
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:4544
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:5732
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:4632
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:2132
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:2356
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:2424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:3136
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:3236
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:1252
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:4896
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        Executes a command shell one-liner
        
        PID:5008
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4808
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        Executes a command shell one-liner
        
        PID:3520
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2612
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:6016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4764
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:4700
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:4436
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:1500
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2876
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:4956
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:2404
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:3948
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:1692
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:1756
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:1472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:4144
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:5888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:6108
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:5504
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        Executes a command shell one-liner
        
        PID:2396
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4468
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:2116
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3748
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:2732
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4804
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:5128
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3332
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:3336
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4148
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:2148
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:2588
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:5236
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:6052
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:3324
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:468
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:5940
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:3416
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:4708
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3020
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:5660
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4508
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        Executes a command shell one-liner
        
        PID:4608
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4940
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:4372
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5400
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:2836
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:1144
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:3132
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5608
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        Executes a command shell one-liner
        
        PID:2392
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:2460
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:4804
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:1224
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:1244
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:1780
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:4756
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4152
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:2600
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3876
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:3084
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4364
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        Executes a command shell one-liner
        
        PID:3892
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2920
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:468
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4884
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:4832
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3696
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:1196
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4192
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        Executes a command shell one-liner
        
        PID:5856
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:944
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:4852
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:3724
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:616
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:1692
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:4612
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:200
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:5596
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:5804
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:4712
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:5624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:3312
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:552
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:4532
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2480
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:4568
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3536
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:4152
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4988
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:3384
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:3424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:5880
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:2516
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:1384
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4436
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:1216
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:4192
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:2508
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:944
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:5464
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:3764
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:2632
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2100
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:476
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:3712
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:4284
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:6040
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:1724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4124
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:5860
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:5800
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:1800
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:200
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:5608
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:5100
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:1572
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:5624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        Executes a command shell one-liner
        
        PID:3304
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3896
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:4256
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4448
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        Executes a command shell one-liner
        
        PID:552
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4596
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:2480
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:5472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:3536
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3808
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:5724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:3088
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        Executes a command shell one-liner
        
        PID:5132
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:2792
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:876
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:2612
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:1788
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:2252
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:4436
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:1932
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:4192
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:4688
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:944
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:2572
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:4500
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4220
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:3636
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:4696
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:5780
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3244
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:5740
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2872
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:3564
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:1692
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:3436
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        Executes a command shell one-liner
        
        PID:3904
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:4672
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:1664
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:6056
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:1324
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:4720
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:3572
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:4448
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:5088
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4536
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:5680
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:3236
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:3332
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:1852
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:1004
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:3088
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        Executes a command shell one-liner
        
        PID:5280
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:2792
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /end /TN AAct
        5⤵
        
        PID:4968
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /end /TN AAct
        6⤵
        
        PID:4520
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks.exe /delete /TN AAct /F
        5⤵
        
        PID:3020
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /delete /TN AAct /F
        6⤵
        
        PID:240
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
        5⤵
        
        PID:1468
      - C:\Windows\System32\taskkill.exe
        
        taskkill.exe /t /f /IM SppExtComObj.Exe
        6⤵
        Kills process with taskkill
        
        PID:5980
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        5⤵
        
        PID:5032
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
        6⤵
        
        PID:3764
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        5⤵
        
        PID:4100
      - C:\Windows\System32\reg.exe
        
        reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
        6⤵
        
        PID:5340
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        5⤵
        
        PID:4876
      - C:\Windows\system32\netsh.exe
        
        Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4204
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:4220
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:6036
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        5⤵
        
        PID:3712
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct.exe"
        6⤵
        
        PID:3244
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        5⤵
        
        PID:2408
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
        6⤵
        
        PID:2828
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        5⤵
        
        PID:5840
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="C:\Windows\AAct_Tools"
        6⤵
        
        PID:4268
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\AppID\activator"
      4⤵
      PID:3148

C:\Windows\AAct_Tools\AAct_x64.exe
"C:\Windows\AAct_Tools\AAct_x64.exe" /win=act /ofs=act
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe stop sppsvc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\System32\sc.exe
    sc.exe stop sppsvc
    3⤵
    - Launches sc.exe
    PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\System32\taskkill.exe
    taskkill.exe /t /f /IM SppExtComObj.Exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_x64.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
    3⤵
    PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
    3⤵
    PID:5308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\System32\taskkill.exe
    taskkill.exe /t /f /IM SppExtComObj.Exe
    3⤵
    - Kills process with taskkill
    PID:4088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
    3⤵
    PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\Windows\System32\SECOPatcher.dll" /reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\SECOPatcher.dll" /reset
    3⤵
    - Modifies file permissions
    PID:3896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mklink "C:\Windows\System32\SECOPatcher.dll" "C:\Windows\AAct_Tools\AAct_files\SECOPatcher.dll"
  2⤵
  - Drops file in System32 directory
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\Windows\System32\SECOPatcher.dll" /findsid *S-1-5-32-545
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\SECOPatcher.dll" /findsid *S-1-5-32-545
    3⤵
    - Modifies file permissions
    PID:5656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files\KMSSS.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\AAct_Tools\AAct_files\KMSSS.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger" /t REG_SZ /d "rundll32.exe SECOPatcher.dll,PatcherMain"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\System32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger" /t REG_SZ /d "rundll32.exe SECOPatcher.dll,PatcherMain"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4356
- C:\Windows\AAct_Tools\AAct_files\KMSSS.exe
  "C:\Windows\AAct_Tools\AAct_files\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /sdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /sdns
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Modifies data under HKEY_USERS
    PID:5500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /act-type 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /act-type 0
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Modifies data under HKEY_USERS
    PID:5948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /ckms
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /ckms
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Modifies data under HKEY_USERS
    PID:3876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /ckms-domain
  2⤵
  - Executes a command shell one-liner
  PID:5716
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /ckms-domain
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Modifies data under HKEY_USERS
    PID:252
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f /reg:64
  2⤵
  PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /skms 10.3.0.20:1688
  2⤵
  PID:3872
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /skms 10.3.0.20:1688
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Modifies data under HKEY_USERS
    PID:4320

C:\Windows\system32\taskhostw.exe
taskhostw.exe "C:\Windows\AAct_Tools\AAct_x64.exe" /win=act /ofs=act
1⤵
PID:1296

C:\Windows\system32\rundll32.exe
rundll32.exe SECOPatcher.dll,PatcherMain C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3744
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  - Loads dropped DLL
  PID:2456
- - C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=6c4de1b8-24bb-4c17-9a77-7b939414c298;NotificationInterval=1440;Trigger=TimerEvent
    3⤵
    PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AAct.xml

Path C:\Windows\AAct_Tools\AAct.xml
Size 3KB
SHA256 e4217c549c1bb7df279656662b91adf6a558f9ea89bf739701e6c93cca9f66c3
MD5 57a5e25495d039136d116b42c41ceff4
SHA1 55a608c5054e25dbbec49ef9d9b8f1d1219124c4
SHA512 e8ff36e8d046ecb2fcb80964e4f102b8c2321eb1fb0bcfdd301510d1347c23cb68c816a8ec9fe8416940cbab621f355a80eb351d005780314e51ba2e2f90be3f
TLSH
T1D671484367EE1109F1F76B5CAEB750628EA7BD455938C46D00AC204DCBF3E2289607BB
MD5 SHA1 SHA512 TLSH

Submit Download

KMSSS.exe

Path C:\Windows\AAct_Tools\AAct_files\KMSSS.exe
Size 33KB
SHA256 fd7499214abaa13bf56d006ab7de78eb8d6adf17926c24ace024d067049bc81d
MD5 01a80aad5dabed1c1580f7e00213cf9d
SHA1 174f9e420ab6c21e59ff7a0e42b8ebb3d742f0ec
SHA512 f254dfc103f79093bbae02d03d5906aafab7a94fa946373037407c270e67f0eb7972f8524cf2d98129bf6af2b8ba50f4ba0fb2b31d9d7b4dcb45d79e689d325b
SSDEEP 384:ZwpXyDvPidEhiXOOB9deeQmKnIicEcXTdof0mhBjpLfh/oCqkg4XZmblE7llJmYN:Zwsbi4i9QebPsnUrukDDd828fRRT
TLSH
T137F207C355F656A1F0F242F5441A9F03DA77B2300AF74A94EB9E80917E91543BF2A9C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AAct_x64.exe

Path C:\Windows\AAct_Tools\AAct_x64.exe
Size 1.6MB
SHA256 3b3ac3f4d4ff33a588867f69928b7f14e68c80af5930a4b29d50e3e53f776b3c
MD5 bc1a945f59614b8aff246b99000866cd
SHA1 acb1fdc44719f9f1e4ae79ae9b00c4effbaa19d1
SHA512 bcc72d87f46c8936732b0db81e1555f2a4685979d299e5cc1edd5731aa8f035d0e1869dd3a109bfb9441617faf75fa6801fa18bb1ef64877a3e67b3c4fdc84ea
SSDEEP 49152:9kCclzReCk7KouJLWNCZhNrfUiGEr1a8lFp:GdepuZWNC1fe01a8lFp
TLSH
T1DF85BC2131119B2FF9C0BFF0EDC57C5587A86CD26C4409613976BE8EF5B29A2BDE110A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRing0x64.sys

Path C:\Windows\AAct_Tools\WinRing0x64.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

act.exe

Path C:\Windows\AAct_Tools\act.exe
Size 7.9MB
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
SSDEEP 98304:/Ss0YJodntQk3Hv7I4a1Shua+XOoca2q4RVHNaAXMbmx4WH5umbLtb/IRHOhrgjY:LqQk3DBNfrkhKj4DbrxLskS3qAP2
TLSH
T1B0866C17F19350ECC56BC170865BA673F671F8691230BE6F2764DB342E22E905A2EF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activator.xml

Path C:\Windows\AAct_Tools\activator.xml
Size 4KB
SHA256 f3563760c4f00865c33dc19ebc7ab9b3ac9af754a095c0a46b861c6253c4871e
MD5 2dcc3cf9ce8e9103155559b83f4a73fd
SHA1 ea3f660dc2f6a0d1d17e0657313c18fcdef42a7c
SHA512 d40dc050380f4af020bdeab038c3bd9c3bc7efb0bffd3b9c9f39736a75f7d8fa51ad16765bd2da26bbd96a6eb216849fb0f961be0c8ae920002bb878ee42f60d
SSDEEP 96:t5JTsIlJTqIffGdiCigN9Ml70HAnkzljZ+:1jFxCLjHo6+
TLSH
T127916F5367EE0119F2F76B5CAEB714618E67BD955938C46D00AC200DCBF3E2289607B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.cmd

Path C:\Windows\AAct_Tools\setup.cmd
Size 489B
SHA256 9926f0c9a09c033bdf1ec09fc404fb97601112335d99a8a7aa2075520fe701d0
MD5 911be174925b5fb41ea4261e2412c8dc
SHA1 224b07247d19d392553f7ca67fbef434e84edb44
SHA512 31d3a44ca952b522af5780ee2b7b68815f8ddbb818528af5c37310d08e10d675313d33efc2aef6d9ea04550be447cf15c94137c4ace268c1583aeb63f59e0507
TLSH
T135F0E91F7313DCE04E16F2220D7F1256F9A968D31015C3D17E692C3484490F6D1A6687
MD5 SHA1 SHA512 TLSH

Submit Download

start.vbs

Path C:\Windows\AAct_Tools\start.vbs
Size 141B
SHA256 be27ae0e53858a23744bdf512fc69af89d5b83a581800f115ff69ddb494ee421
MD5 9253e74beec68756c257046232646aeb
SHA1 c73c19846d73144ace822a4e8724a54035b42d7a
SHA512 03d4d6fefe1676cf50e3028c2377a8630f3da24206be074ce58db54b2934b134f567798227fd6147b972e886e43348cee0da71e30fc79daabcfd6f02f06d5b06
TLSH
T1DAC09B19DD3DC461E9DEC16957F55108A79CA9435036FD680654A48543144605735273
MD5 SHA1 SHA512 TLSH

Submit Download

SECOPatcher.dll

Path C:\Windows\System32\SECOPatcher.dll
Size 5KB
SHA256 03b9136fb9414eba54d0890d9efad1cc0e40abd55ebe2a5bd5554ea7bcc6d2be
MD5 8998be879286d69a2522109650fec7b8
SHA1 92c280dba4d7dfd2e7827daecc76ff5e22ca1083
SHA512 1c414de081c1bee6f2ec953738bb5203532b3f9987c14dd2598f1d4e8e6a397f8fd111d811ab65774f46e1a6daef19637a803c5e9a5f9f5d3ce75a43d67c5185
SSDEEP 96:T5A81SxEbEqGUtqDXNNawdvDdDfD1mDOd:1FbZqDXNb7xfD1mDOd
TLSH
T1E5C18213A3516DE3C4A893314BB5A43395A773F84533EACE4C64AF6CAD6A8897079F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-42-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/1232-49-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/1232-48-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/1232-43-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/1232-45-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/1232-46-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/1232-47-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/2456-36-0x0000000066DC0000-0x0000000066DC5000-memory.dmp

Download

memory/3744-37-0x0000000066DC0000-0x0000000066DC5000-memory.dmp

Download

memory/6004-24-0x0000000140000000-0x0000000140346000-memory.dmp

Download

memory/6004-38-0x0000000140000000-0x0000000140346000-memory.dmp

Download