b5b642ed4a07bda1ddbe94d27499d51ba1691de3dcb93f58881222f7fe343877

Analysis

max time kernel
75s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DDoS.exe 8.12.1982.msi
Size 96.4MB
Sample260804-b5ph5aah98
SHA256 b5b642ed4a07bda1ddbe94d27499d51ba1691de3dcb93f58881222f7fe343877
MD5 49032f43574000d24d5f8342b9c0bd53
SHA1 95c3ae4d8fa6410efd29b68e64a37f86dece8ca1
SHA512 737a8f86cd413e5705903a176639184bfebe694c87299d0a461ea1f93ca24d1232921b82b695434619ccc71e497af8e7335841346c482779f2b596ed7c01bee5
SSDEEP 1572864:aLYuWGCuaD6ShFJI2x/aka1aJc1yVNmAf/cLCK7UKRSqSLY6Pug+rc+h+:aL/GP6ShHVxSNyfmAsLCsUKRSoyHi+
TLSH
T14628334AB947F3FEF919E87B92BBF01A85267ECCA0146D63F9F1B6D615727040E00642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 45 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2500	powershell.exe
5460	powershell.exe
6368	powershell.exe
124	powershell.exe
3672	powershell.exe
6356	powershell.exe
2520	powershell.exe
4136	powershell.exe
6512	powershell.exe
4596	powershell.exe
6444	powershell.exe
5668	powershell.exe
3220	powershell.exe
1684	powershell.exe
4412	powershell.exe
5344	powershell.exe
4496	powershell.exe
2984	powershell.exe
5020	powershell.exe
5020	powershell.exe
1260	powershell.exe
6204	powershell.exe
6612	powershell.exe
2464	powershell.exe
2588	powershell.exe
3968	powershell.exe
5696	powershell.exe
4144	powershell.exe
3040	powershell.exe
3636	powershell.exe
5124	powershell.exe
4852	powershell.exe
6632	powershell.exe
1524	powershell.exe
2316	powershell.exe
3636	powershell.exe
6336	powershell.exe
976	powershell.exe
980	powershell.exe
5112	powershell.exe
2952	powershell.exe
4328	powershell.exe
2496	powershell.exe
3016	powershell.exe
2104	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1616	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
6044	DDoS.exe.exe
4384	DDoS.exe.exe
440	DDoS.exe.exe

Loads dropped DLL 10 IoCs

pid	Process
6044	DDoS.exe.exe
6044	DDoS.exe.exe
6044	DDoS.exe.exe
440	DDoS.exe.exe
4384	DDoS.exe.exe
4384	DDoS.exe.exe
4384	DDoS.exe.exe
4384	DDoS.exe.exe
4384	DDoS.exe.exe
4384	DDoS.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	api.gofile.io
21	discord.com
24	discord.com
25	discord.com
26	discord.com
4	discord.com
12	discord.com
19	api.gofile.io
22	discord.com
23	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ipapi.co
7	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF90A09D752CEC8ABF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCB5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF98525827A39B1DA9.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F17D099D-1F6F-4886-B2FF-F5E188B6BB84}	msiexec.exe
File created	C:\Windows\Installer\e59ee60.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEE4F39F3CC001216.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA388B5DC57947D98.TMP	msiexec.exe
File created	C:\Windows\Installer\e59ee5e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ee5e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5460	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6040	cmd.exe
6904	cmd.exe
2424	cmd.exe
2560	cmd.exe
5264	cmd.exe
4628	cmd.exe
1460	cmd.exe
7008	cmd.exe
2932	cmd.exe
1260	cmd.exe
700	cmd.exe
2940	cmd.exe
7112	cmd.exe
4120	cmd.exe
2500	cmd.exe
4320	cmd.exe
4280	cmd.exe
3892	cmd.exe
6140	cmd.exe
6120	cmd.exe
3272	cmd.exe
2004	cmd.exe
1268	cmd.exe
1684	cmd.exe
2224	cmd.exe
7144	cmd.exe
4164	cmd.exe
5920	cmd.exe
6928	cmd.exe
7152	cmd.exe
5728	cmd.exe
4136	cmd.exe
4072	cmd.exe
2824	cmd.exe
6308	cmd.exe
2580	cmd.exe
4280	cmd.exe
4500	cmd.exe
3928	cmd.exe
7040	cmd.exe
4164	cmd.exe
1344	cmd.exe
2624	cmd.exe
2804	cmd.exe
3480	cmd.exe
6232	cmd.exe
7032	cmd.exe
3448	cmd.exe
6320	cmd.exe
2060	cmd.exe
7080	cmd.exe
5652	cmd.exe
1260	cmd.exe
4532	cmd.exe
6192	cmd.exe
556	cmd.exe
2004	cmd.exe
6236	cmd.exe
1628	cmd.exe
7056	cmd.exe
4620	cmd.exe
4636	cmd.exe
3580	cmd.exe
1264	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6040	cmd.exe
3136	netsh.exe
5852	cmd.exe
5284	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	DDoS.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	DDoS.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	DDoS.exe.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4592	ipconfig.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
3952	taskkill.exe
5400	taskkill.exe
1260	taskkill.exe
2788	taskkill.exe
4296	taskkill.exe
4848	taskkill.exe
1864	taskkill.exe
5532	taskkill.exe
3052	taskkill.exe
3624	taskkill.exe
4620	taskkill.exe
1616	taskkill.exe
2316	taskkill.exe
1060	taskkill.exe
3528	taskkill.exe
4648	taskkill.exe
2384	taskkill.exe
5708	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5740	msiexec.exe
5740	msiexec.exe
5096	WMIC.exe
5096	WMIC.exe
5096	WMIC.exe
5096	WMIC.exe
1524	powershell.exe
1524	powershell.exe
1524	powershell.exe
2520	powershell.exe
2520	powershell.exe
2500	powershell.exe
2500	powershell.exe
2952	powershell.exe
4136	powershell.exe
2952	powershell.exe
4136	powershell.exe
4328	powershell.exe
4328	powershell.exe
2952	powershell.exe
2520	powershell.exe
4136	powershell.exe
2500	powershell.exe
4328	powershell.exe
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
2588	powershell.exe
2588	powershell.exe
5460	powershell.exe
5460	powershell.exe
1260	powershell.exe
1260	powershell.exe
2104	powershell.exe
2104	powershell.exe
2496	powershell.exe
2496	powershell.exe
4596	powershell.exe
4596	powershell.exe
4412	powershell.exe
4412	powershell.exe
3016	powershell.exe
3016	powershell.exe
2588	powershell.exe
5532	WMIC.exe
5532	WMIC.exe
5532	WMIC.exe
5532	WMIC.exe
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5020	msiexec.exe
Token: SeSecurityPrivilege	5740	msiexec.exe
Token: SeCreateTokenPrivilege	5020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5020	msiexec.exe
Token: SeLockMemoryPrivilege	5020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5020	msiexec.exe
Token: SeMachineAccountPrivilege	5020	msiexec.exe
Token: SeTcbPrivilege	5020	msiexec.exe
Token: SeSecurityPrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeLoadDriverPrivilege	5020	msiexec.exe
Token: SeSystemProfilePrivilege	5020	msiexec.exe
Token: SeSystemtimePrivilege	5020	msiexec.exe
Token: SeProfSingleProcessPrivilege	5020	msiexec.exe
Token: SeIncBasePriorityPrivilege	5020	msiexec.exe
Token: SeCreatePagefilePrivilege	5020	msiexec.exe
Token: SeCreatePermanentPrivilege	5020	msiexec.exe
Token: SeBackupPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeShutdownPrivilege	5020	msiexec.exe
Token: SeDebugPrivilege	5020	msiexec.exe
Token: SeAuditPrivilege	5020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5020	msiexec.exe
Token: SeChangeNotifyPrivilege	5020	msiexec.exe
Token: SeRemoteShutdownPrivilege	5020	msiexec.exe
Token: SeUndockPrivilege	5020	msiexec.exe
Token: SeSyncAgentPrivilege	5020	msiexec.exe
Token: SeEnableDelegationPrivilege	5020	msiexec.exe
Token: SeManageVolumePrivilege	5020	msiexec.exe
Token: SeImpersonatePrivilege	5020	msiexec.exe
Token: SeCreateGlobalPrivilege	5020	msiexec.exe
Token: SeBackupPrivilege	5816	vssvc.exe
Token: SeRestorePrivilege	5816	vssvc.exe
Token: SeAuditPrivilege	5816	vssvc.exe
Token: SeBackupPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeBackupPrivilege	5808	srtasks.exe
Token: SeRestorePrivilege	5808	srtasks.exe
Token: SeSecurityPrivilege	5808	srtasks.exe
Token: SeTakeOwnershipPrivilege	5808	srtasks.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeBackupPrivilege	5808	srtasks.exe
Token: SeRestorePrivilege	5808	srtasks.exe
Token: SeSecurityPrivilege	5808	srtasks.exe
Token: SeTakeOwnershipPrivilege	5808	srtasks.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5020	msiexec.exe
5020	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5020	msiexec.exe
5740	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 5808	5740	msiexec.exe	94
PID 5740 wrote to memory of 6044	5740	msiexec.exe	97
PID 6044 wrote to memory of 892	6044	DDoS.exe.exe	98
PID 892 wrote to memory of 3288	892	cmd.exe	367
PID 6044 wrote to memory of 6040	6044	DDoS.exe.exe	101
PID 6040 wrote to memory of 3136	6040	cmd.exe	103
PID 6044 wrote to memory of 556	6044	DDoS.exe.exe	104
PID 556 wrote to memory of 5096	556	cmd.exe	106
PID 6044 wrote to memory of 5264	6044	DDoS.exe.exe	107
PID 5264 wrote to memory of 1524	5264	cmd.exe	356
PID 6044 wrote to memory of 2424	6044	DDoS.exe.exe	111
PID 6044 wrote to memory of 2004	6044	DDoS.exe.exe	241
PID 6044 wrote to memory of 3580	6044	DDoS.exe.exe	113
PID 6044 wrote to memory of 1864	6044	DDoS.exe.exe	360
PID 6044 wrote to memory of 5664	6044	DDoS.exe.exe	262
PID 6044 wrote to memory of 1344	6044	DDoS.exe.exe	116
PID 6044 wrote to memory of 1460	6044	DDoS.exe.exe	409
PID 6044 wrote to memory of 5460	6044	DDoS.exe.exe	280
PID 6044 wrote to memory of 4280	6044	DDoS.exe.exe	216
PID 6044 wrote to memory of 4940	6044	DDoS.exe.exe	120
PID 6044 wrote to memory of 2560	6044	DDoS.exe.exe	121
PID 6044 wrote to memory of 2224	6044	DDoS.exe.exe	122
PID 6044 wrote to memory of 1684	6044	DDoS.exe.exe	264
PID 6044 wrote to memory of 4772	6044	DDoS.exe.exe	124
PID 6044 wrote to memory of 5912	6044	DDoS.exe.exe	125
PID 6044 wrote to memory of 4164	6044	DDoS.exe.exe	341
PID 6044 wrote to memory of 2824	6044	DDoS.exe.exe	127
PID 6044 wrote to memory of 3060	6044	DDoS.exe.exe	129
PID 6044 wrote to memory of 4636	6044	DDoS.exe.exe	131
PID 6044 wrote to memory of 3036	6044	DDoS.exe.exe	133
PID 6044 wrote to memory of 1628	6044	DDoS.exe.exe	245
PID 6044 wrote to memory of 1192	6044	DDoS.exe.exe	137
PID 6044 wrote to memory of 3024	6044	DDoS.exe.exe	139
PID 6044 wrote to memory of 4620	6044	DDoS.exe.exe	388
PID 6044 wrote to memory of 3008	6044	DDoS.exe.exe	143
PID 6044 wrote to memory of 4072	6044	DDoS.exe.exe	145
PID 6044 wrote to memory of 3672	6044	DDoS.exe.exe	378
PID 6044 wrote to memory of 1268	6044	DDoS.exe.exe	149
PID 6044 wrote to memory of 2972	6044	DDoS.exe.exe	151
PID 6044 wrote to memory of 4640	6044	DDoS.exe.exe	153
PID 6044 wrote to memory of 1260	6044	DDoS.exe.exe	413
PID 6044 wrote to memory of 4328	6044	DDoS.exe.exe	158
PID 6044 wrote to memory of 2952	6044	DDoS.exe.exe	159
PID 6044 wrote to memory of 4136	6044	DDoS.exe.exe	234
PID 6044 wrote to memory of 2500	6044	DDoS.exe.exe	161
PID 6044 wrote to memory of 2520	6044	DDoS.exe.exe	163
PID 6044 wrote to memory of 4628	6044	DDoS.exe.exe	165
PID 6044 wrote to memory of 4384	6044	DDoS.exe.exe	185
PID 6044 wrote to memory of 4384	6044	DDoS.exe.exe	185
PID 6044 wrote to memory of 440	6044	DDoS.exe.exe	186
PID 6044 wrote to memory of 5852	6044	DDoS.exe.exe	188
PID 4628 wrote to memory of 3952	4628	cmd.exe	348
PID 3024 wrote to memory of 1532	3024	cmd.exe	190
PID 5852 wrote to memory of 5284	5852	cmd.exe	285
PID 6044 wrote to memory of 3448	6044	DDoS.exe.exe	193
PID 6044 wrote to memory of 2536	6044	DDoS.exe.exe	265
PID 3448 wrote to memory of 4648	3448	cmd.exe	197
PID 6044 wrote to memory of 700	6044	DDoS.exe.exe	198
PID 700 wrote to memory of 5532	700	cmd.exe	299
PID 6044 wrote to memory of 2940	6044	DDoS.exe.exe	201
PID 2940 wrote to memory of 5400	2940	cmd.exe	203
PID 6044 wrote to memory of 1264	6044	DDoS.exe.exe	204
PID 1264 wrote to memory of 2384	1264	cmd.exe	206
PID 6044 wrote to memory of 2000	6044	DDoS.exe.exe	207

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\DDoS.exe 8.12.1982.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5808
- C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe
  "C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\System32\chcp.com
      chcp
      4⤵
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "openssl version"
    3⤵
    - Executes a command shell one-liner
    PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "npm -v"
    3⤵
    - Executes a command shell one-liner
    PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
    3⤵
    - Executes a command shell one-liner
    PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
    3⤵
    PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
    3⤵
    PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "brew --version"
    3⤵
    - Executes a command shell one-liner
    PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
    3⤵
    - Executes a command shell one-liner
    PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
    3⤵
    PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "git --version"
    3⤵
    - Executes a command shell one-liner
    PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
    3⤵
    PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
    3⤵
    - Executes a command shell one-liner
    PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "php -v"
    3⤵
    - Executes a command shell one-liner
    PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
    3⤵
    PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "docker --version"
    3⤵
    PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
    3⤵
    - Executes a command shell one-liner
    PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
    3⤵
    - Executes a command shell one-liner
    PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "perl -v"
    3⤵
    PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
    3⤵
    PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
    3⤵
    PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -version
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
    3⤵
    - Executes a command shell one-liner
    PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
    3⤵
    PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bash --version"
    3⤵
    - Executes a command shell one-liner
    PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
    3⤵
    PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "fish --version"
    3⤵
    - Executes a command shell one-liner
    PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bun -v"
    3⤵
    PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "deno -v"
    3⤵
    PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "node -v"
    3⤵
    - Executes a command shell one-liner
    PID:1260
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4328
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2952
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2500
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3952
- - C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ddos.exe" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2504 --field-trial-handle=2508,i,11715975251702132332,13055086312677206469,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4384
- - C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\ddos.exe\DDoS.exe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ddos.exe" --mojo-platform-channel-handle=2588 --field-trial-handle=2508,i,11715975251702132332,13055086312677206469,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
    3⤵
    PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
    3⤵
    PID:2000
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM kometa.exe
      4⤵
      Kills process with taskkill
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
    3⤵
    PID:3876
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM orbitum.exe
      4⤵
      Kills process with taskkill
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4320
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM centbrowser.exe
      4⤵
      Kills process with taskkill
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4280
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM 7star.exe
      4⤵
      Kills process with taskkill
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2624
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM sputnik.exe
      4⤵
      Kills process with taskkill
      PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    PID:956
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6120
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM epicprivacybrowser.exe
      4⤵
      Kills process with taskkill
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4500
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM uran.exe
      4⤵
      Kills process with taskkill
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3892
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4136
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM iridium.exe
      4⤵
      Kills process with taskkill
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3272
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2004
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM waterfox.exe
      4⤵
      Kills process with taskkill
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3928
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1628
  - - C:\Windows\System32\taskkill.exe
      taskkill /F /IM arc.exe
      4⤵
      Kills process with taskkill
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    PID:2060
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:4088
  - - C:\Windows\System32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
    3⤵
    PID:2140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
    3⤵
    PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
    3⤵
    PID:4848
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3624
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
      4⤵
      PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
    3⤵
    PID:5664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:2536
  - - C:\Windows\System32\net.exe
      net session
      4⤵
      PID:2232
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
    3⤵
    PID:4380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
    3⤵
    - Executes a command shell one-liner
    PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
    3⤵
    PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5020
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1260
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2588
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5284
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2496
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2104
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:576
  - - C:\Windows\System32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:3480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version,vendor,installDate /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "openssl version"
    3⤵
    - Executes a command shell one-liner
    PID:6904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "npm -v"
    3⤵
    PID:6912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
    3⤵
    PID:6920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
    3⤵
    - Executes a command shell one-liner
    PID:6928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
    3⤵
    PID:6944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "brew --version"
    3⤵
    PID:6960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
    3⤵
    PID:6968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
    3⤵
    PID:6976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "git --version"
    3⤵
    PID:6984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
    3⤵
    PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
    3⤵
    PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "php -v"
    3⤵
    - Executes a command shell one-liner
    PID:7040
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
    3⤵
    - Executes a command shell one-liner
    PID:7056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "docker --version"
    3⤵
    PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
    3⤵
    - Executes a command shell one-liner
    PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
    3⤵
    PID:7096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "perl -v"
    3⤵
    - Executes a command shell one-liner
    PID:7112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
    3⤵
    PID:7124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:7144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
    3⤵
    PID:7160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:6192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -version
      4⤵
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
    3⤵
    - Executes a command shell one-liner
    PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:6236
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bash --version"
    3⤵
    - Executes a command shell one-liner
    PID:6232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
    3⤵
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "fish --version"
    3⤵
    - Executes a command shell one-liner
    PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bun -v"
    3⤵
    - Executes a command shell one-liner
    PID:6140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "deno -v"
    3⤵
    - Executes a command shell one-liner
    PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "node -v"
    3⤵
    - Executes a command shell one-liner
    PID:4164
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6336
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3288
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3040
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6368
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:2580
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    PID:7016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3636
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    PID:4300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      PID:6452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Executes a command shell one-liner
    PID:4120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6444
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6356
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4620
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6204
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5124
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3968
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
    3⤵
    PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    - Executes a command shell one-liner
    PID:2932
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4144
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5668
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:6592
  - - C:\Windows\System32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:2092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:1260
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2588
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version,vendor,installDate /format:list
      4⤵
      PID:7056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:5436
  - - C:\Windows\System32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:3000
  - - C:\Windows\System32\ROUTE.EXE
      route print
      4⤵
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
    3⤵
    PID:6480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic service get name,displayName,state,startMode,pathName /format:list
      4⤵
      PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    - Executes a command shell one-liner
    PID:5652
  - - C:\Windows\System32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:5088
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2464
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4852
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    PID:4988
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Executes a command shell one-liner
    PID:5920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6632
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6512
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3220
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    - Executes a command shell one-liner
    PID:2500
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5112
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4496
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    - Executes a command shell one-liner
    PID:7032
  - - C:\Windows\System32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
    3⤵
    PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "py --version"
    3⤵
    PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python --version"
    3⤵
    PID:6948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
    3⤵
    PID:7048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
    3⤵
    - Executes a command shell one-liner
    PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      PID:6400
    - - C:\Windows\Temp\{BACAAC7F-E272-4F3F-93DA-F36906B0355F}\.cr\python312_installer.exe
        
        "C:\Windows\Temp\{BACAAC7F-E272-4F3F-93DA-F36906B0355F}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
        5⤵
        
        PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      PID:3740
    - - C:\Windows\Temp\{36F4AF87-2F87-4FCF-8A79-2D6319BADFFD}\.cr\python312_installer.exe
        
        "C:\Windows\Temp\{36F4AF87-2F87-4FCF-8A79-2D6319BADFFD}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=772 -burn.filehandle.self=776 /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
        5⤵
        
        PID:1048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2172

C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce
1⤵
PID:4792
- C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260804024730.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
  2⤵
  PID:6460
- - C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260804024730.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ee5f.rbs

Path C:\Config.Msi\e59ee5f.rbs
Size 39KB
SHA256 a88da9f3be321b50e7ac35a048bbdde5115c50bd63b7cf408f8aa3829c5a8c7c
MD5 066b0f191548ca7b24f5b33a7ed4e335
SHA1 1b7e7836eb435b0006fb58b31d9059127d7f1fde
SHA512 475d5c10cae8ac635b467e20a72f62b0a575b3bfdc96c54267745481f68557621b1d49c46a07d09ce0734b949ffc754bb255ac56cf5fe99e7ae487fbe2028a77
SSDEEP 768:QcMTGTqT2TkTZTITOT7T7TrTiTbTnTPxTOTyTGTOTsTVTSFTkTdT2T3T2TSTNTvh:Yk402Ra833HAXTP58wk8udSt2V0D0Ql5
TLSH
T1E603205226FA8CC9955144AF33B19349D2DBB944AECEFB0D6E4FCF1CCA835EAA4D1140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee64.rbs

Path C:\Config.Msi\e59ee64.rbs
Size 8KB
SHA256 6ac1511f566de2798ee3cfbe98d67b51a2243fdb9fb9e6a30a693cbf0c732a82
MD5 d770cceb2107fa8a7dcacb6db8ccf4ec
SHA1 dede0a596adbe1ccfbb6ba3ab5d62d3fb5cc48d2
SHA512 d53670c0df975c245f3754df6cda8fda4be80a64c312be5b33716fab5f827c3072a1098bdac8f92b347fd152f85d5ba543d8ce6020005995efd3dcdd13b3282f
SSDEEP 96:TmgJiMiifiA+rteChxZ4UoRHbXBHAZECsTlmkUoRHbXBHAZEC6jFKUIaTlmPIOwO:KAK8CZXIBgZrImIBgZrggNIpw
TLSH
T13A022251F228C8D3E4A93779C343131473A6E3F99240336B14CF82641F767A89FAA997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee69.rbs

Path C:\Config.Msi\e59ee69.rbs
Size 12KB
SHA256 8899fb1174f96cd669f442e8fd5de0629bb0acaaedc387d75b18afbb9c10f629
MD5 87f23fcf176fe37feda9e51e6ee3d0b1
SHA1 9b69a7b09e892b27cf34393580bf4f4de7c0f360
SHA512 01a9251098225ac280ae177b164316ffeb77210290682c96c02517ab02c5f7f1c409614c231611801211a012d4fba9b7140d37915dd2ae13d1e4d8163dfbc4ed
SSDEEP 192:KnvUUcIA4DrQvfaPowHV3ayYZU+PQCTXA3ZrIlA3ZrRoF5CIpq:KnvUUc14DrQvfaPowZDYO+fAp4ApaF5y
TLSH
T1DA4241017270C1C3D49E22798726172477FBD2ED8700765B0A8F81B99F47BCACADA18B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee70.rbs

Path C:\Config.Msi\e59ee70.rbs
Size 14KB
SHA256 6ce22e2d277c6548ba0c2c0ca03b79fc273e3c762d016229c0c3592649881446
MD5 35d96166c013c99dd5f94ed851e04e8b
SHA1 bb0664400dc63371f78bba61d366a4cd0cc7f545
SHA512 b148d816e16951583c82b45893b1b7195d6d1ab2a1e7bec0f98243bc09fae9a7d7e279dda803dee9b7295dd165a609b8303b44654f16cb33d0a0c3dcf08ed1c6
SSDEEP 192:n9ReVbkRMVbnowbOe7A7dsF9dxLa2MZk0W3u:n9ReVARMV7bI76FtPMuJ3u
TLSH
T1706263037270C0D3C45D623D87371768BBE7D2EC8704628B426E91BD9F56BCAD9DA08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee72.rbf

Path C:\Config.Msi\e59ee72.rbf
Size 102KB
SHA256 4d6f5f81a4bca11191c4c7c6b43632694d0a4ce74e068619d8fdc161d469859a
MD5 0cfdf7db1b81d067d3dad75f6abb312b
SHA1 f0ef24bbb793b93c33274fadd7cba49fbda8a56e
SHA512 a6bc090e3b3f52a9588adee2f60f2ee19cc0181a031335d107fe5f240cbd853933c0e939f80e861f21148892106fd7929c80edcad651f58458f82df79811d838
SSDEEP 1536:7j1vKbuEYE+9z2wp+FavGmhMn+IhzZtzg/fZRIytH/9jfI38VMDxl:7BvKbuAs0FNmhMn+IhNC/fZRwIk
TLSH
T167A3F48A6A1E8191D5709471437B87F26B2C2F62A9C3C68DA7C17F06E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee73.rbf

Path C:\Config.Msi\e59ee73.rbf
Size 101KB
SHA256 d72294fb338bc2fc8896d25a7395a4db466425427e1559e77185d5135a830681
MD5 72afbe203882951dc77a5cf6dcc07ffe
SHA1 e42f23434e8323d695cb249e686692794dba385e
SHA512 426dc0e1ab31b895f7b5ef04ee4be52f562c03e856bda4569cd7052fe0aa3f15404f240f73bf8d2bb5e87240aa6671fdf8601d8b52e3b21a858a7f2e21b089dd
SSDEEP 1536:Csef7hIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/T5sCytH/9wfIW44zqrhO:CsOSwMpdCq/IM8uIGf1/T5sLW4IKh
TLSH
T1F5A30841E62DBDCDE508D4314A75D4F26D24ED727680A51EB7F37F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee74.rbf

Path C:\Config.Msi\e59ee74.rbf
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee75.rbf

Path C:\Config.Msi\e59ee75.rbf
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee76.rbf

Path C:\Config.Msi\e59ee76.rbf
Size 36KB
SHA256 e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419
MD5 b52c821c7750804295e23b9e94525085
SHA1 ee762ae623c98f53c89a0d8f4143c6c61ab807d8
SHA512 b5d680ce02ed9677ed905fa3257925bae1e80ece565d161b50a94a479b409d10b7f1b8340675b257900c856d8c3e37abacbf818287b56c5a72b97b1e5bbeaed5
SSDEEP 768:ofTr69CItDmXPkVDXz/kSsixKioLU68RfKoMlPLZ1FDYzGBAcTQgug3qfF:oX69CItQPkVDzDsioLU6EfKoILZ1FYwE
TLSH
T1D8F2D66EBF0903734AE1C2517E96A8C9F31DA13E375B1954306CD10C2B3B929A3BF569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee77.rbf

Path C:\Config.Msi\e59ee77.rbf
Size 1.7MB
SHA256 64ed57507cec59380f87c4b0ee57f202e2f54c2fc0b3fb41446a031df3ec17e4
MD5 b0fd318347035c1088e4da385aced068
SHA1 6e637c8eb30c76b8f4c8a518e1e8369f4fe396db
SHA512 7f8834ea4500e1450aac5f90e65c8dc39e9da9586ad0b23a879343c1e65e1e8c41b63c4449a47cdead8aef514c2be6cafce153fe4e9cc7bf2ab34c33580efa2a
SSDEEP 49152:hh/TF6hKWgW/zeOREp42erd+1lwVDwi/GBy4:oDg
TLSH
T16685FA5AA54F93B20673414DE1AEF39AE326C178231D15427CACE1DE2205AEC937F79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee78.rbf

Path C:\Config.Msi\e59ee78.rbf
Size 74KB
SHA256 150c470f9943b806b44312efdec85755f22f8d7d52b31f93a9af3c43e8627381
MD5 b35f68a3086562c4d5453faad5a3474e
SHA1 673904ff9b305a6600e47ad715289122ec0b046a
SHA512 6ec80921942b3bd3c85ef24a2de5454a34a3ad11a1bc69b601aea7b873e318073c0b2d78c26685999f78ec64a86282c08c53ab8d77e41c661ae968ea52c08176
SSDEEP 1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
TLSH
T1CA73C3A33B9EBEDEE8A089B16B76C1D72D54FC554646200FB0B1BB1670752A3381DD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee79.rbf

Path C:\Config.Msi\e59ee79.rbf
Size 76KB
SHA256 fda28a734788a3f175cb6aed4daeb5f05f0e49f6a272ccd2051ba337f7b3b42f
MD5 b1c9980131a3f20e344aa3aa2c8dea49
SHA1 0fe02f0ed5e56bbe7e4e98b1dca061ed17fbf5c7
SHA512 84ca107ace44fa1964c6c1ea93fc767bde88363339fc426a3d660da53c84bade14f1fae99c494483bf2b5312938d84b0c1733c85e82592b8ffe8a28f76186a3a
SSDEEP 768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
TLSH
T11A73C4473AAE92A9E9F05130577783F31B2C2DAA51A0E10AB5917B45B63C1E3790DF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee7a.rbf

Path C:\Config.Msi\e59ee7a.rbf
Size 81KB
SHA256 c4ec1845a5724b2a83500f3bd940355e2fe26efc6b4fe6c208365359a6130da1
MD5 1a8230030d821cf8ea57ce03aaead737
SHA1 12656788b1fbe4d2375ecc2989a4d9da69caa0d6
SHA512 af6356dc67249e724ae30f65ddefb4e53c6f2703da32fd5f135598bbd6189bee70950242f52985478de99979d1271eec9f4e2981a29a9bc02c673e9b668fd0c1
SSDEEP 1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
TLSH
T1B58326433B4EBEE4E89423B1647AC5971E64ED6910C2259FF0C5BB0736B95A3380CE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee7d.rbs

Path C:\Config.Msi\e59ee7d.rbs
Size 8KB
SHA256 5260c1b4e38d43f0005cef40d73ea7fe6c891633dea4499aea213ba7074adaa4
MD5 793c91176ab08c25016f9c92e9922198
SHA1 a33a99ae843d3946e1b44688894543e84f672c50
SHA512 bc3ad9459a2e9a3c69b23e08f2afb63eb0320bf0b25d7d05523d08f9c77d5ce2f2098a80090228a063d55656ea785b955e810f16f10ae915b8e90b6fe99f9a90
SSDEEP 96:JmgJiMMzLUt8R7RV2XhsbxmPt8R7Rr2XhsbCjnkAKUmU0nmP0Qy8ecRZxRaJbowX:kVR+mbtR0mbxowlXF
TLSH
T108022112F238C9C3E9A93739831313547797E3F99344136B20CF46641E35BA8EAEA597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee7e.rbf

Path C:\Config.Msi\e59ee7e.rbf
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ee7f.rbf

Path C:\Config.Msi\e59ee7f.rbf
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download