b5b642ed4a07bda1ddbe94d27499d51ba1691de3dcb93f58881222f7fe343877

Analysis

max time kernel
70s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DDoS.exe 8.12.1982.msi
Size 96.4MB
Sample260804-b5fafszgra
SHA256 b5b642ed4a07bda1ddbe94d27499d51ba1691de3dcb93f58881222f7fe343877
MD5 49032f43574000d24d5f8342b9c0bd53
SHA1 95c3ae4d8fa6410efd29b68e64a37f86dece8ca1
SHA512 737a8f86cd413e5705903a176639184bfebe694c87299d0a461ea1f93ca24d1232921b82b695434619ccc71e497af8e7335841346c482779f2b596ed7c01bee5
SSDEEP 1572864:aLYuWGCuaD6ShFJI2x/aka1aJc1yVNmAf/cLCK7UKRSqSLY6Pug+rc+h+:aL/GP6ShHVxSNyfmAsLCsUKRSoyHi+
TLSH
T14628334AB947F3FEF919E87B92BBF01A85267ECCA0146D63F9F1B6D615727040E00642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 53 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe
7112	powershell.exe
4480	powershell.exe
4444	powershell.exe
2020	powershell.exe
204	powershell.exe
1152	powershell.exe
6236	powershell.exe
4216	powershell.exe
6128	powershell.exe
4312	powershell.exe
6056	powershell.exe
6844	powershell.exe
5580	powershell.exe
7008	powershell.exe
6188	powershell.exe
6116	powershell.exe
7160	powershell.exe
3892	powershell.exe
7104	powershell.exe
1940	powershell.exe
4340	powershell.exe
2416	powershell.exe
6756	powershell.exe
5740	powershell.exe
4188	powershell.exe
1052	powershell.exe
6108	powershell.exe
2856	powershell.exe
6328	powershell.exe
7004	powershell.exe
3620	powershell.exe
4548	powershell.exe
412	powershell.exe
6336	powershell.exe
412	powershell.exe
1816	powershell.exe
7012	powershell.exe
6840	powershell.exe
6948	powershell.exe
5024	powershell.exe
7100	powershell.exe
4956	powershell.exe
716	powershell.exe
3460	powershell.exe
3032	powershell.exe
6928	powershell.exe
4704	powershell.exe
1940	powershell.exe
6468	powershell.exe
7052	powershell.exe
6808	powershell.exe
6748	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3432	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
608	DDoS.exe.exe
5532	DDoS.exe.exe
3256	DDoS.exe.exe

Loads dropped DLL 10 IoCs

pid	Process
608	DDoS.exe.exe
608	DDoS.exe.exe
608	DDoS.exe.exe
5532	DDoS.exe.exe
3256	DDoS.exe.exe
5532	DDoS.exe.exe
5532	DDoS.exe.exe
5532	DDoS.exe.exe
5532	DDoS.exe.exe
5532	DDoS.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
4	api.gofile.io
14	discord.com
17	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ipapi.co
4	ip-api.com
11	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF538C457B2CB5F35A.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F17D099D-1F6F-4886-B2FF-F5E188B6BB84}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF369BD098B40E03FC.TMP	msiexec.exe
File created	C:\Windows\Installer\e59744e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB243B366BFAAFE7.TMP	msiexec.exe
File created	C:\Windows\Installer\e59744c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59744c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI841A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF94BC25979D3DFBF0.TMP	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
7112	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6436	cmd.exe
724	cmd.exe
404	cmd.exe
1440	cmd.exe
2900	cmd.exe
1276	cmd.exe
716	cmd.exe
5444	cmd.exe
412	cmd.exe
2972	cmd.exe
4140	cmd.exe
4388	cmd.exe
6408	cmd.exe
2372	cmd.exe
3388	cmd.exe
6240	cmd.exe
6872	cmd.exe
1552	cmd.exe
4392	cmd.exe
2616	cmd.exe
1116	cmd.exe
4208	cmd.exe
1088	cmd.exe
5896	cmd.exe
6132	cmd.exe
204	cmd.exe
3604	cmd.exe
1948	cmd.exe
6084	cmd.exe
1940	cmd.exe
6900	cmd.exe
5632	cmd.exe
3984	cmd.exe
5296	cmd.exe
2672	cmd.exe
3328	cmd.exe
3408	cmd.exe
1972	cmd.exe
3892	cmd.exe
5000	cmd.exe
4188	cmd.exe
5580	cmd.exe
832	cmd.exe
5036	cmd.exe
6116	cmd.exe
7020	cmd.exe
4632	cmd.exe
3512	cmd.exe
5420	cmd.exe
248	cmd.exe
6900	cmd.exe
704	cmd.exe
4392	cmd.exe
712	cmd.exe
1480	cmd.exe
3744	cmd.exe
1852	cmd.exe
3728	cmd.exe
3316	cmd.exe
6524	cmd.exe
2604	cmd.exe
5792	cmd.exe
5292	cmd.exe
5332	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2460	cmd.exe
5000	netsh.exe
3604	cmd.exe
3428	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1228	ipconfig.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
2364	taskkill.exe
928	taskkill.exe
1972	taskkill.exe
6340	taskkill.exe
2068	taskkill.exe
5428	taskkill.exe
1400	taskkill.exe
4628	taskkill.exe
5304	taskkill.exe
2976	taskkill.exe
4216	taskkill.exe
4164	taskkill.exe
1560	taskkill.exe
6116	taskkill.exe
5868	taskkill.exe
992	taskkill.exe
3208	taskkill.exe
852	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	msiexec.exe
4560	msiexec.exe
3048	WMIC.exe
3048	WMIC.exe
3048	WMIC.exe
3048	WMIC.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2020	powershell.exe
2020	powershell.exe
4216	powershell.exe
4216	powershell.exe
4548	powershell.exe
4548	powershell.exe
4444	powershell.exe
4444	powershell.exe
5740	powershell.exe
5740	powershell.exe
4216	powershell.exe
5740	powershell.exe
4548	powershell.exe
4444	powershell.exe
2020	powershell.exe
4312	powershell.exe
4312	powershell.exe
412	powershell.exe
412	powershell.exe
204	powershell.exe
204	powershell.exe
3892	powershell.exe
3892	powershell.exe
412	powershell.exe
3892	powershell.exe
204	powershell.exe
4312	powershell.exe
2372	WMIC.exe
2372	WMIC.exe
2372	WMIC.exe
2372	WMIC.exe
6188	powershell.exe
6188	powershell.exe
6188	powershell.exe
5564	WMIC.exe
5564	WMIC.exe
5564	WMIC.exe
5564	WMIC.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
6236	powershell.exe
6236	powershell.exe
6268	WMIC.exe
6268	WMIC.exe
6268	WMIC.exe
6268	WMIC.exe
6236	powershell.exe
6328	powershell.exe
6328	powershell.exe
6328	powershell.exe
6116	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1320	msiexec.exe
Token: SeSecurityPrivilege	4560	msiexec.exe
Token: SeCreateTokenPrivilege	1320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1320	msiexec.exe
Token: SeLockMemoryPrivilege	1320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1320	msiexec.exe
Token: SeMachineAccountPrivilege	1320	msiexec.exe
Token: SeTcbPrivilege	1320	msiexec.exe
Token: SeSecurityPrivilege	1320	msiexec.exe
Token: SeTakeOwnershipPrivilege	1320	msiexec.exe
Token: SeLoadDriverPrivilege	1320	msiexec.exe
Token: SeSystemProfilePrivilege	1320	msiexec.exe
Token: SeSystemtimePrivilege	1320	msiexec.exe
Token: SeProfSingleProcessPrivilege	1320	msiexec.exe
Token: SeIncBasePriorityPrivilege	1320	msiexec.exe
Token: SeCreatePagefilePrivilege	1320	msiexec.exe
Token: SeCreatePermanentPrivilege	1320	msiexec.exe
Token: SeBackupPrivilege	1320	msiexec.exe
Token: SeRestorePrivilege	1320	msiexec.exe
Token: SeShutdownPrivilege	1320	msiexec.exe
Token: SeDebugPrivilege	1320	msiexec.exe
Token: SeAuditPrivilege	1320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1320	msiexec.exe
Token: SeChangeNotifyPrivilege	1320	msiexec.exe
Token: SeRemoteShutdownPrivilege	1320	msiexec.exe
Token: SeUndockPrivilege	1320	msiexec.exe
Token: SeSyncAgentPrivilege	1320	msiexec.exe
Token: SeEnableDelegationPrivilege	1320	msiexec.exe
Token: SeManageVolumePrivilege	1320	msiexec.exe
Token: SeImpersonatePrivilege	1320	msiexec.exe
Token: SeCreateGlobalPrivilege	1320	msiexec.exe
Token: SeBackupPrivilege	5180	vssvc.exe
Token: SeRestorePrivilege	5180	vssvc.exe
Token: SeAuditPrivilege	5180	vssvc.exe
Token: SeBackupPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeBackupPrivilege	3548	srtasks.exe
Token: SeRestorePrivilege	3548	srtasks.exe
Token: SeSecurityPrivilege	3548	srtasks.exe
Token: SeTakeOwnershipPrivilege	3548	srtasks.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeBackupPrivilege	3548	srtasks.exe
Token: SeRestorePrivilege	3548	srtasks.exe
Token: SeSecurityPrivilege	3548	srtasks.exe
Token: SeTakeOwnershipPrivilege	3548	srtasks.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1320	msiexec.exe
1320	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1320	msiexec.exe
4560	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3548	4560	msiexec.exe	94
PID 4560 wrote to memory of 608	4560	msiexec.exe	97
PID 608 wrote to memory of 2604	608	DDoS.exe.exe	98
PID 2604 wrote to memory of 1328	2604	cmd.exe	100
PID 608 wrote to memory of 2460	608	DDoS.exe.exe	101
PID 2460 wrote to memory of 5000	2460	cmd.exe	242
PID 608 wrote to memory of 1480	608	DDoS.exe.exe	104
PID 1480 wrote to memory of 3048	1480	cmd.exe	106
PID 608 wrote to memory of 3984	608	DDoS.exe.exe	107
PID 3984 wrote to memory of 2856	3984	cmd.exe	109
PID 608 wrote to memory of 5296	608	DDoS.exe.exe	111
PID 608 wrote to memory of 5972	608	DDoS.exe.exe	274
PID 608 wrote to memory of 5640	608	DDoS.exe.exe	113
PID 608 wrote to memory of 1456	608	DDoS.exe.exe	296
PID 608 wrote to memory of 5420	608	DDoS.exe.exe	225
PID 608 wrote to memory of 4512	608	DDoS.exe.exe	116
PID 608 wrote to memory of 6132	608	DDoS.exe.exe	117
PID 608 wrote to memory of 1852	608	DDoS.exe.exe	118
PID 608 wrote to memory of 5332	608	DDoS.exe.exe	119
PID 608 wrote to memory of 3328	608	DDoS.exe.exe	228
PID 608 wrote to memory of 4392	608	DDoS.exe.exe	329
PID 608 wrote to memory of 3892	608	DDoS.exe.exe	285
PID 608 wrote to memory of 4180	608	DDoS.exe.exe	304
PID 608 wrote to memory of 5800	608	DDoS.exe.exe	128
PID 608 wrote to memory of 3744	608	DDoS.exe.exe	271
PID 608 wrote to memory of 1896	608	DDoS.exe.exe	279
PID 608 wrote to memory of 5488	608	DDoS.exe.exe	134
PID 608 wrote to memory of 704	608	DDoS.exe.exe	342
PID 608 wrote to memory of 2548	608	DDoS.exe.exe	139
PID 608 wrote to memory of 5580	608	DDoS.exe.exe	140
PID 608 wrote to memory of 5576	608	DDoS.exe.exe	284
PID 608 wrote to memory of 1972	608	DDoS.exe.exe	227
PID 608 wrote to memory of 3540	608	DDoS.exe.exe	144
PID 608 wrote to memory of 204	608	DDoS.exe.exe	283
PID 608 wrote to memory of 5792	608	DDoS.exe.exe	147
PID 608 wrote to memory of 3388	608	DDoS.exe.exe	351
PID 608 wrote to memory of 412	608	DDoS.exe.exe	281
PID 608 wrote to memory of 404	608	DDoS.exe.exe	151
PID 608 wrote to memory of 4388	608	DDoS.exe.exe	282
PID 608 wrote to memory of 5292	608	DDoS.exe.exe	153
PID 608 wrote to memory of 832	608	DDoS.exe.exe	154
PID 608 wrote to memory of 5740	608	DDoS.exe.exe	155
PID 608 wrote to memory of 4548	608	DDoS.exe.exe	156
PID 608 wrote to memory of 4216	608	DDoS.exe.exe	224
PID 608 wrote to memory of 4444	608	DDoS.exe.exe	158
PID 608 wrote to memory of 2020	608	DDoS.exe.exe	159
PID 608 wrote to memory of 1116	608	DDoS.exe.exe	160
PID 608 wrote to memory of 5532	608	DDoS.exe.exe	185
PID 608 wrote to memory of 5532	608	DDoS.exe.exe	185
PID 608 wrote to memory of 3256	608	DDoS.exe.exe	186
PID 1116 wrote to memory of 2364	1116	cmd.exe	276
PID 3540 wrote to memory of 248	3540	cmd.exe	339
PID 608 wrote to memory of 3604	608	DDoS.exe.exe	189
PID 3604 wrote to memory of 3428	3604	cmd.exe	324
PID 608 wrote to memory of 4880	608	DDoS.exe.exe	193
PID 608 wrote to memory of 4188	608	DDoS.exe.exe	417
PID 4880 wrote to memory of 2068	4880	cmd.exe	197
PID 608 wrote to memory of 5176	608	DDoS.exe.exe	198
PID 5176 wrote to memory of 4628	5176	cmd.exe	200
PID 608 wrote to memory of 2900	608	DDoS.exe.exe	201
PID 2900 wrote to memory of 4164	2900	cmd.exe	464
PID 608 wrote to memory of 200	608	DDoS.exe.exe	204
PID 200 wrote to memory of 5304	200	cmd.exe	206
PID 608 wrote to memory of 2152	608	DDoS.exe.exe	207

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\DDoS.exe 8.12.1982.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe
  "C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\System32\chcp.com
      chcp
      4⤵
      PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "openssl version"
    3⤵
    - Executes a command shell one-liner
    PID:5296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "npm -v"
    3⤵
    PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
    3⤵
    PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
    3⤵
    PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
    3⤵
    - Executes a command shell one-liner
    PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "brew --version"
    3⤵
    PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
    3⤵
    - Executes a command shell one-liner
    PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
    3⤵
    - Executes a command shell one-liner
    PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "git --version"
    3⤵
    - Executes a command shell one-liner
    PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
    3⤵
    PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
    3⤵
    - Executes a command shell one-liner
    PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "php -v"
    3⤵
    PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
    3⤵
    PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "docker --version"
    3⤵
    - Executes a command shell one-liner
    PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
    3⤵
    PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
    3⤵
    PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "perl -v"
    3⤵
    - Executes a command shell one-liner
    PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
    3⤵
    PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
    3⤵
    PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -version
      4⤵
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
    3⤵
    - Executes a command shell one-liner
    PID:204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bash --version"
    3⤵
    PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
    3⤵
    - Executes a command shell one-liner
    PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "fish --version"
    3⤵
    - Executes a command shell one-liner
    PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bun -v"
    3⤵
    - Executes a command shell one-liner
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "deno -v"
    3⤵
    - Executes a command shell one-liner
    PID:5292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "node -v"
    3⤵
    - Executes a command shell one-liner
    PID:832
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5740
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4216
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4444
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2364
- - C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ddos.exe" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2440 --field-trial-handle=2444,i,2137580328275044066,10413143102429297817,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5532
- - C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ddos.exe" --mojo-platform-channel-handle=2864 --field-trial-handle=2444,i,2137580328275044066,10413143102429297817,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
    3⤵
    PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
    3⤵
    PID:2152
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM kometa.exe
      4⤵
      Kills process with taskkill
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
    3⤵
    PID:572
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM orbitum.exe
      4⤵
      Kills process with taskkill
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
    3⤵
    PID:4300
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM centbrowser.exe
      4⤵
      Kills process with taskkill
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
    3⤵
    PID:1876
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM 7star.exe
      4⤵
      Kills process with taskkill
      PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2672
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM sputnik.exe
      4⤵
      Kills process with taskkill
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    PID:2080
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
    3⤵
    PID:5420
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM epicprivacybrowser.exe
      4⤵
      Kills process with taskkill
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3328
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM uran.exe
      4⤵
      Kills process with taskkill
      PID:992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    PID:1148
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3728
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM iridium.exe
      4⤵
      Kills process with taskkill
      PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
    3⤵
    PID:2668
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1276
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM waterfox.exe
      4⤵
      Kills process with taskkill
      PID:6340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "openssl version"
    3⤵
    - Executes a command shell one-liner
    PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "npm -v"
    3⤵
    - Executes a command shell one-liner
    PID:1940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
    3⤵
    - Executes a command shell one-liner
    PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
    3⤵
    - Executes a command shell one-liner
    PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
    3⤵
    PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "brew --version"
    3⤵
    - Executes a command shell one-liner
    PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
    3⤵
    PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
    3⤵
    - Executes a command shell one-liner
    PID:2972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "git --version"
    3⤵
    - Executes a command shell one-liner
    PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
    3⤵
    PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
    3⤵
    PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
    3⤵
    - Executes a command shell one-liner
    PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "php -v"
    3⤵
    PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
    3⤵
    - Executes a command shell one-liner
    PID:5444
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "docker --version"
    3⤵
    PID:1812
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
    3⤵
    - Executes a command shell one-liner
    PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
    3⤵
    PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "perl -v"
    3⤵
    - Executes a command shell one-liner
    PID:2372
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
    3⤵
    PID:3020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
    3⤵
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
    3⤵
    PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
    3⤵
    PID:5868
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -version
      4⤵
      PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
    3⤵
    PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
    3⤵
    PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bash --version"
    3⤵
    PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
    3⤵
    - Executes a command shell one-liner
    PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "fish --version"
    3⤵
    - Executes a command shell one-liner
    PID:248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bun -v"
    3⤵
    PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "deno -v"
    3⤵
    - Executes a command shell one-liner
    PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "node -v"
    3⤵
    PID:1896
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4312
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:412
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:204
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
    3⤵
    - Executes a command shell one-liner
    PID:6900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1088
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM arc.exe
      4⤵
      Kills process with taskkill
      PID:852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    PID:3316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Executes a command shell one-liner
    PID:6436
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6188
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1152
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:724
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    PID:920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6056
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:5896
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version,vendor,installDate /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    PID:3408
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:5784
  - - C:\Windows\System32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
    3⤵
    - Executes a command shell one-liner
    PID:6240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
    3⤵
    - Executes a command shell one-liner
    PID:5632
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
    3⤵
    PID:6824
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5768
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
      4⤵
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
    3⤵
    PID:6544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6220
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2220
  - - C:\Windows\System32\net.exe
      net session
      4⤵
      PID:4688
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
    3⤵
    - Executes a command shell one-liner
    PID:7020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
    3⤵
    PID:5772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
      4⤵
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
    3⤵
    PID:988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4340
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7012
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6844
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:7112
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6840
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6808
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:992
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6336
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6748
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    - Executes a command shell one-liner
    PID:6524
  - - C:\Windows\System32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:6724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    - Executes a command shell one-liner
    PID:6408
  - - C:\Windows\System32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    - Executes a command shell one-liner
    PID:4632
  - - C:\Windows\System32\ROUTE.EXE
      route print
      4⤵
      PID:6584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
    3⤵
    PID:2448
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6116
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic service get name,displayName,state,startMode,pathName /format:list
      4⤵
      PID:6772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:4660
  - - C:\Windows\System32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:3512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Executes a command shell one-liner
    PID:6872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5580
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4480
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7052
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6948
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7004
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7160
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2416
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7008
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:4188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version,vendor,installDate /format:list
      4⤵
      PID:4904
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    PID:5524
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1816
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5564
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6128
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2364
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    - Executes a command shell one-liner
    PID:1440
  - - C:\Windows\System32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      PID:6212
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    - Executes a command shell one-liner
    PID:4140
  - - C:\Windows\System32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:5960
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7100
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5024
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    - Executes a command shell one-liner
    PID:1552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    - Executes a command shell one-liner
    PID:4392
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7104
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6328
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:1948
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4164
  - - C:\Windows\System32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:4988
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6188
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    - Executes a command shell one-liner
    PID:2616
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6468
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1940
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    - Executes a command shell one-liner
    PID:6900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3432
  - - C:\Windows\System32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:6500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2496

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:248

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv vGdwuEKlaEy8Tlkq9vYs0w.0.2
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59744d.rbs

Path C:\Config.Msi\e59744d.rbs
Size 39KB
SHA256 5defa4055c4737ac26e45cf2377f08682d581fcbcb1472662ab936e5948cda65
MD5 22e49831304f8219d2918df1cfd9d438
SHA1 87852f417e7d200517fcf3ee680a0e6fa2b24444
SHA512 7ac1688b8dd262aa82bd598813e019616ce5a94366be8281f98dc2f02bc1b946a179dcfa018898405fb7af1673460f5c618883ae67fcc292120faf7137383496
SSDEEP 768:LcMTGTqT2TkTZTITOT7T7TrTiTbTnTPxTOTyTGTOTsTVTSFTkTdT2T3T2TSTNTvC:bk402Ra833HAXTP58wk8udSt2V0D0Qlq
TLSH
T1E303314226F98CC9955244AF33B29349D2DBA944AFCEFB0D6D4FCE1CCE835DAA8D5140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 84d93374d26c12260afa2c84dc3c43d746d1e1a21468204ee5a52bf8c4bddf33
MD5 6fe720a70745bfbcb65d76fd036a3a1d
SHA1 11a19af0a4d69576d3da29d4a96d787b0c55c85d
SHA512 1a9d2c155adc0e47862ef25ae90d7a99c0c29d739f585644c66e2c6fe38575b96a246ebfdfe16f4bfeefc72c240b002eb588755daa5f865b76d94011db2acf84
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download