5d4ad3e19d7bd5da58e294dff1e4c5f47fa65bfb208581a96537e87db967cccd

Analysis

user interaction
yes
max time kernel
297s
max time network
264s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vALİhhRa.exe
Size 23.9MB
Sample260809-1vblyscf76
SHA256 5d4ad3e19d7bd5da58e294dff1e4c5f47fa65bfb208581a96537e87db967cccd
MD5 0fd0605f9162d6533f46de40058e74f5
SHA1 a6cfba819ec10f845454eac303d64046d82d83d2
SHA512 086f0ba43f7b698e163df29f64a75a796dfb3f3023626ac9b0275377c72e8293414482c8d30b219a9c001e4f5faf14cb809e0bf050a8d28c1503345f3f1da55f
SSDEEP 393216:PAyfmlwjFA4oZm1Ftz7hdSw1aMDOoJ+MRQls5WmlFWGE:bfmlSHoZsh9dSkpOATlFWG
TLSH
T13947E1D7F6B321E5D8B6C1349247732AB8B174654338DBDB76844A164B33BE0A93EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 42 IoCs

pid	Process
1392	AMIDEWINx64.EXE
4856	AMIDEWINx64.EXE
1792	AMIDEWINx64.EXE
1464	amigendrv64.sys
4800	AMIDEWINx64.EXE
4896	AMIDEWINx64.EXE
1092	AMIDEWINx64.EXE
4776	AMIDEWINx64.EXE
244	AMIDEWINx64.EXE
1152	AMIDEWINx64.EXE
3956	AMIDEWINx64.EXE
428	AMIDEWINx64.EXE
668	AMIDEWINx64.EXE
1008	AMIDEWINx64.EXE
4760	AMIDEWINx64.EXE
1764	AMIDEWINx64.EXE
2684	AMIDEWINx64.EXE
2768	AMIDEWINx64.EXE
4524	AMIDEWINx64.EXE
3124	AMIDEWINx64.EXE
4312	AMIDEWINx64.EXE
4560	AMIDEWINx64.EXE
4356	AMIDEWINx64.EXE
3212	AMIDEWINx64.EXE
4224	AMIDEWINx64.EXE
4784	AMIDEWINx64.EXE
4976	AMIDEWINx64.EXE
3464	AMIDEWINx64.EXE
2576	AMIDEWINx64.EXE
4144	AMIDEWINx64.EXE
1832	AMIDEWINx64.EXE
5056	AMIDEWINx64.EXE
4608	AMIDEWINx64.EXE
4076	AMIDEWINx64.EXE
772	AMIDEWINx64.EXE
996	AMIDEWINx64.EXE
4528	AMIDEWINx64.EXE
2864	AMIDEWINx64.EXE
3444	AMIDEWINx64.EXE
564	AMIDEWINx64.EXE
3820	AMIDEWINx64.EXE
1628	AMIDEWINx64.EXE

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	vALİhhRa.exe
File opened (read-only)	\??\V:	vALİhhRa.exe
File opened (read-only)	\??\Y:	vALİhhRa.exe
File opened (read-only)	\??\Z:	vALİhhRa.exe
File opened (read-only)	\??\G:	vALİhhRa.exe
File opened (read-only)	\??\H:	vALİhhRa.exe
File opened (read-only)	\??\K:	vALİhhRa.exe
File opened (read-only)	\??\S:	vALİhhRa.exe
File opened (read-only)	\??\U:	vALİhhRa.exe
File opened (read-only)	\??\X:	vALİhhRa.exe
File opened (read-only)	\??\B:	vALİhhRa.exe
File opened (read-only)	\??\L:	vALİhhRa.exe
File opened (read-only)	\??\M:	vALİhhRa.exe
File opened (read-only)	\??\N:	vALİhhRa.exe
File opened (read-only)	\??\Q:	vALİhhRa.exe
File opened (read-only)	\??\R:	vALİhhRa.exe
File opened (read-only)	\??\W:	vALİhhRa.exe
File opened (read-only)	\??\A:	vALİhhRa.exe
File opened (read-only)	\??\I:	vALİhhRa.exe
File opened (read-only)	\??\O:	vALİhhRa.exe
File opened (read-only)	\??\P:	vALİhhRa.exe
File opened (read-only)	\??\T:	vALİhhRa.exe
File opened (read-only)	\??\E:	vALİhhRa.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2860	sc.exe
4584	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe
1576	powershell.exe
3732	powershell.exe
3440	powershell.exe
3288	powershell.exe
1032	powershell.exe

Executes a command shell one-liner 1 TTPs 41 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3168	cmd.exe
1300	cmd.exe
4808	cmd.exe
2952	cmd.exe
2972	cmd.exe
1656	cmd.exe
4944	cmd.exe
4160	cmd.exe
1568	cmd.exe
3740	cmd.exe
1084	cmd.exe
4136	cmd.exe
3744	cmd.exe
2708	cmd.exe
4476	cmd.exe
4908	cmd.exe
1052	cmd.exe
2060	cmd.exe
2444	cmd.exe
1808	cmd.exe
3132	cmd.exe
3988	cmd.exe
1468	cmd.exe
1860	cmd.exe
2120	cmd.exe
2160	cmd.exe
3376	cmd.exe
1140	cmd.exe
1964	cmd.exe
3124	cmd.exe
1980	cmd.exe
1764	cmd.exe
2472	cmd.exe
3328	cmd.exe
3708	cmd.exe
4704	cmd.exe
3644	cmd.exe
4776	cmd.exe
4368	cmd.exe
3924	cmd.exe
5100	cmd.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	vALİhhRa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	vALİhhRa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	vALİhhRa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	vALİhhRa.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307864653158588"	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3440	powershell.exe
3440	powershell.exe
3288	powershell.exe
3288	powershell.exe
1032	powershell.exe
1032	powershell.exe
1992	powershell.exe
1992	powershell.exe
1576	powershell.exe
1576	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4964	vALİhhRa.exe

Suspicious behavior: LoadsDriver 40 IoCs

pid	Process
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3008	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3008	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	2252	WMIC.exe
Token: SeSecurityPrivilege	2252	WMIC.exe
Token: SeTakeOwnershipPrivilege	2252	WMIC.exe
Token: SeLoadDriverPrivilege	2252	WMIC.exe
Token: SeSystemProfilePrivilege	2252	WMIC.exe
Token: SeSystemtimePrivilege	2252	WMIC.exe
Token: SeProfSingleProcessPrivilege	2252	WMIC.exe
Token: SeIncBasePriorityPrivilege	2252	WMIC.exe
Token: SeCreatePagefilePrivilege	2252	WMIC.exe
Token: SeBackupPrivilege	2252	WMIC.exe
Token: SeRestorePrivilege	2252	WMIC.exe
Token: SeShutdownPrivilege	2252	WMIC.exe
Token: SeDebugPrivilege	2252	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2252	WMIC.exe
Token: SeRemoteShutdownPrivilege	2252	WMIC.exe
Token: SeUndockPrivilege	2252	WMIC.exe
Token: SeManageVolumePrivilege	2252	WMIC.exe
Token: 33	2252	WMIC.exe
Token: 34	2252	WMIC.exe
Token: 35	2252	WMIC.exe
Token: 36	2252	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2252	WMIC.exe
Token: SeSecurityPrivilege	2252	WMIC.exe
Token: SeTakeOwnershipPrivilege	2252	WMIC.exe
Token: SeLoadDriverPrivilege	2252	WMIC.exe
Token: SeSystemProfilePrivilege	2252	WMIC.exe
Token: SeSystemtimePrivilege	2252	WMIC.exe
Token: SeProfSingleProcessPrivilege	2252	WMIC.exe
Token: SeIncBasePriorityPrivilege	2252	WMIC.exe
Token: SeCreatePagefilePrivilege	2252	WMIC.exe
Token: SeBackupPrivilege	2252	WMIC.exe
Token: SeRestorePrivilege	2252	WMIC.exe
Token: SeShutdownPrivilege	2252	WMIC.exe
Token: SeDebugPrivilege	2252	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2252	WMIC.exe
Token: SeRemoteShutdownPrivilege	2252	WMIC.exe
Token: SeUndockPrivilege	2252	WMIC.exe
Token: SeManageVolumePrivilege	2252	WMIC.exe
Token: 33	2252	WMIC.exe
Token: 34	2252	WMIC.exe
Token: 35	2252	WMIC.exe
Token: 36	2252	WMIC.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	WMIC.exe
Token: SeSecurityPrivilege	2996	WMIC.exe
Token: SeTakeOwnershipPrivilege	2996	WMIC.exe
Token: SeLoadDriverPrivilege	2996	WMIC.exe
Token: SeSystemProfilePrivilege	2996	WMIC.exe
Token: SeSystemtimePrivilege	2996	WMIC.exe
Token: SeProfSingleProcessPrivilege	2996	WMIC.exe
Token: SeIncBasePriorityPrivilege	2996	WMIC.exe
Token: SeCreatePagefilePrivilege	2996	WMIC.exe
Token: SeBackupPrivilege	2996	WMIC.exe
Token: SeRestorePrivilege	2996	WMIC.exe
Token: SeShutdownPrivilege	2996	WMIC.exe
Token: SeDebugPrivilege	2996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2996	WMIC.exe
Token: SeRemoteShutdownPrivilege	2996	WMIC.exe
Token: SeUndockPrivilege	2996	WMIC.exe
Token: SeManageVolumePrivilege	2996	WMIC.exe
Token: 33	2996	WMIC.exe
Token: 34	2996	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4964	vALİhhRa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2972	4964	vALİhhRa.exe	80
PID 4964 wrote to memory of 2472	4964	vALİhhRa.exe	83
PID 2472 wrote to memory of 2252	2472	cmd.exe	85
PID 4964 wrote to memory of 3328	4964	vALİhhRa.exe	87
PID 3328 wrote to memory of 3440	3328	cmd.exe	89
PID 4964 wrote to memory of 3988	4964	vALİhhRa.exe	90
PID 3988 wrote to memory of 2996	3988	cmd.exe	92
PID 4964 wrote to memory of 3924	4964	vALİhhRa.exe	93
PID 3924 wrote to memory of 1392	3924	cmd.exe	95
PID 4964 wrote to memory of 1656	4964	vALİhhRa.exe	96
PID 1656 wrote to memory of 1792	1656	cmd.exe	98
PID 4964 wrote to memory of 3708	4964	vALİhhRa.exe	99
PID 3708 wrote to memory of 2952	3708	cmd.exe	101
PID 4964 wrote to memory of 4944	4964	vALİhhRa.exe	102
PID 4944 wrote to memory of 2936	4944	cmd.exe	104
PID 4964 wrote to memory of 4704	4964	vALİhhRa.exe	105
PID 4704 wrote to memory of 4716	4704	cmd.exe	107
PID 4964 wrote to memory of 3744	4964	vALİhhRa.exe	108
PID 3744 wrote to memory of 1764	3744	cmd.exe	110
PID 4964 wrote to memory of 3644	4964	vALİhhRa.exe	111
PID 3644 wrote to memory of 2156	3644	cmd.exe	113
PID 4964 wrote to memory of 5100	4964	vALİhhRa.exe	114
PID 5100 wrote to memory of 3288	5100	cmd.exe	116
PID 4964 wrote to memory of 3168	4964	vALİhhRa.exe	117
PID 3168 wrote to memory of 1988	3168	cmd.exe	119
PID 4964 wrote to memory of 2708	4964	vALİhhRa.exe	120
PID 2708 wrote to memory of 844	2708	cmd.exe	122
PID 4964 wrote to memory of 1468	4964	vALİhhRa.exe	123
PID 1468 wrote to memory of 1392	1468	cmd.exe	125
PID 1468 wrote to memory of 4856	1468	cmd.exe	127
PID 1468 wrote to memory of 1792	1468	cmd.exe	128
PID 1468 wrote to memory of 4800	1468	cmd.exe	130
PID 1468 wrote to memory of 4896	1468	cmd.exe	131
PID 1468 wrote to memory of 1092	1468	cmd.exe	132
PID 1468 wrote to memory of 4776	1468	cmd.exe	133
PID 1468 wrote to memory of 244	1468	cmd.exe	134
PID 1468 wrote to memory of 1152	1468	cmd.exe	135
PID 1468 wrote to memory of 3956	1468	cmd.exe	136
PID 1468 wrote to memory of 428	1468	cmd.exe	137
PID 1468 wrote to memory of 668	1468	cmd.exe	138
PID 1468 wrote to memory of 1008	1468	cmd.exe	139
PID 1468 wrote to memory of 4760	1468	cmd.exe	140
PID 1468 wrote to memory of 1764	1468	cmd.exe	141
PID 1468 wrote to memory of 2684	1468	cmd.exe	142
PID 1468 wrote to memory of 2768	1468	cmd.exe	143
PID 1468 wrote to memory of 4524	1468	cmd.exe	144
PID 1468 wrote to memory of 3124	1468	cmd.exe	145
PID 1468 wrote to memory of 4312	1468	cmd.exe	146
PID 1468 wrote to memory of 4560	1468	cmd.exe	147
PID 1468 wrote to memory of 4356	1468	cmd.exe	148
PID 1468 wrote to memory of 3212	1468	cmd.exe	149
PID 1468 wrote to memory of 4224	1468	cmd.exe	150
PID 1468 wrote to memory of 4784	1468	cmd.exe	151
PID 1468 wrote to memory of 4976	1468	cmd.exe	152
PID 1468 wrote to memory of 3464	1468	cmd.exe	153
PID 1468 wrote to memory of 2576	1468	cmd.exe	154
PID 1468 wrote to memory of 4144	1468	cmd.exe	155
PID 1468 wrote to memory of 1832	1468	cmd.exe	156
PID 1468 wrote to memory of 5056	1468	cmd.exe	157
PID 1468 wrote to memory of 4608	1468	cmd.exe	158
PID 1468 wrote to memory of 4076	1468	cmd.exe	159
PID 1468 wrote to memory of 772	1468	cmd.exe	160
PID 1468 wrote to memory of 996	1468	cmd.exe	161
PID 1468 wrote to memory of 4528	1468	cmd.exe	162

C:\Users\Admin\AppData\Local\Temp\vALİhhRa.exe
"C:\Users\Admin\AppData\Local\Temp\vALİhhRa.exe"
1⤵
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /c exit 0
  2⤵
  - Executes a command shell one-liner
  PID:2972
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get SpecVersion /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get SpecVersion /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$t=Get-Tpm;if(-not $t.TpmPresent){'Unavailable'}elseif($t.TpmPresent -and $t.TpmReady){'Enabled'}elseif($t.TpmPresent){'Disabled'}else{'Unavailable'}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$t=Get-Tpm;if(-not $t.TpmPresent){'Unavailable'}elseif($t.TpmPresent -and $t.TpmReady){'Enabled'}elseif($t.TpmPresent){'Disabled'}else{'Unavailable'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic cpu get Name /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic path win32_networkadapter get Name,AdapterTypeId,PNPDeviceID /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter get Name,AdapterTypeId,PNPDeviceID /format:list
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic baseboard get Manufacturer /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic diskdrive get model,serialnumber /format:csv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get model,serialnumber /format:csv
    3⤵
    PID:2952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic cpu get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber /format:list
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic bios get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber /format:list
    3⤵
    PID:4716
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic baseboard get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber /format:list
    3⤵
    PID:1764
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic path win32_computersystemproduct get UUID /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get UUID /format:list
    3⤵
    PID:2156
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$h=(Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256).PublicKeyHash;if($h){$h}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$h=(Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256).PublicKeyHash;if($h){$h}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3288
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersionInfo /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersionInfo /format:list
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersion /format:list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersion /format:list
    3⤵
    PID:844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c spoof_random.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /ID 02/28/2014
    3⤵
    - Executes dropped EXE
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SV 17727221972913829487
    3⤵
    - Executes dropped EXE
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SS 2954612400823331951
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SF 1711532369321126750
    3⤵
    - Executes dropped EXE
    PID:4800
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SU AUTO
    3⤵
    - Executes dropped EXE
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SK 1030831019237087687
    3⤵
    - Executes dropped EXE
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SF 30672867213131831
    3⤵
    - Executes dropped EXE
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BV 28598286601162613988
    3⤵
    - Executes dropped EXE
    PID:244
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BS 8595109162272815744
    3⤵
    - Executes dropped EXE
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BT 828326999283231150
    3⤵
    - Executes dropped EXE
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BLC 5383105141014229988
    3⤵
    - Executes dropped EXE
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CV 1411113301033415153
    3⤵
    - Executes dropped EXE
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CS 9395715035646161
    3⤵
    - Executes dropped EXE
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CM 2552425418690630399
    3⤵
    - Executes dropped EXE
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CA 1034072462430720746
    3⤵
    - Executes dropped EXE
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CSK 1974882952146926091
    3⤵
    - Executes dropped EXE
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /PSN 199324460499610774
    3⤵
    - Executes dropped EXE
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /PAT 1798428371265819935
    3⤵
    - Executes dropped EXE
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /PPN 955428531498415103
    3⤵
    - Executes dropped EXE
    PID:3124
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BSH 3 14888301271024229319
    3⤵
    - Executes dropped EXE
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BMH 3 32240113871471326580
    3⤵
    - Executes dropped EXE
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BPH 3 1617710878264925523
    3⤵
    - Executes dropped EXE
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BVH 3 469297472378212135
    3⤵
    - Executes dropped EXE
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CSH 4 1110650322512319706
    3⤵
    - Executes dropped EXE
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CMH 4 129516567145792512
    3⤵
    - Executes dropped EXE
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CVH 4 309686905267518066
    3⤵
    - Executes dropped EXE
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CAH 4 11561306782299922249
    3⤵
    - Executes dropped EXE
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CSKH 4 3145828703534024952
    3⤵
    - Executes dropped EXE
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BTH 3 1295592151750123759
    3⤵
    - Executes dropped EXE
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BLCH 3 24901315351779213454
    3⤵
    - Executes dropped EXE
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /IVN 31443136741802022119
    3⤵
    - Executes dropped EXE
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /IV 3.6.1
    3⤵
    - Executes dropped EXE
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SM 3577243531434027768
    3⤵
    - Executes dropped EXE
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SP 259073236759834567
    3⤵
    - Executes dropped EXE
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BM 1460231512095013678
    3⤵
    - Executes dropped EXE
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BP 224193597186457945
    3⤵
    - Executes dropped EXE
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SCO 1 25912253381451719117
    3⤵
    - Executes dropped EXE
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /OS 1 6842675617613628
    3⤵
    - Executes dropped EXE
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /OS 3 9335260531516015606
    3⤵
    - Executes dropped EXE
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /OS 4 1769315471041915922
    3⤵
    - Executes dropped EXE
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /OS 5 1137631800237618701
    3⤵
    - Executes dropped EXE
    PID:1628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop winmgmt >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1808
- - C:\Windows\system32\sc.exe
    sc stop winmgmt
    3⤵
    - Launches sc.exe
    PID:2860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start winmgmt >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4476
- - C:\Windows\system32\sc.exe
    sc start winmgmt
    3⤵
    - Launches sc.exe
    PID:4584
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get SpecVersion /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1860
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get SpecVersion /format:list
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$t=Get-Tpm;if(-not $t.TpmPresent){'Unavailable'}elseif($t.TpmPresent -and $t.TpmReady){'Enabled'}elseif($t.TpmPresent){'Disabled'}else{'Unavailable'}"
  2⤵
  - Executes a command shell one-liner
  PID:4160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$t=Get-Tpm;if(-not $t.TpmPresent){'Unavailable'}elseif($t.TpmPresent -and $t.TpmReady){'Enabled'}elseif($t.TpmPresent){'Disabled'}else{'Unavailable'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic cpu get Name /format:list
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name /format:list
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic path win32_networkadapter get Name,AdapterTypeId,PNPDeviceID /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1052
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter get Name,AdapterTypeId,PNPDeviceID /format:list
    3⤵
    PID:1592
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic baseboard get Manufacturer /format:list
  2⤵
  - Executes a command shell one-liner
  PID:3132
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:4816
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic diskdrive get model,serialnumber /format:csv
  2⤵
  - Executes a command shell one-liner
  PID:1300
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get model,serialnumber /format:csv
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic cpu get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  PID:4776
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber /format:list
    3⤵
    PID:2952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic bios get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1568
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber /format:list
    3⤵
    PID:1008
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic baseboard get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1764
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber /format:list
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic path win32_computersystemproduct get UUID /format:list
  2⤵
  - Executes a command shell one-liner
  PID:3124
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get UUID /format:list
    3⤵
    PID:4136
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$h=(Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256).PublicKeyHash;if($h){$h}"
  2⤵
  - Executes a command shell one-liner
  PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$h=(Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256).PublicKeyHash;if($h){$h}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1992
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersionInfo /format:list
  2⤵
  - Executes a command shell one-liner
  PID:4368
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersionInfo /format:list
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersion /format:list
  2⤵
  - Executes a command shell one-liner
  PID:4808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get ManufacturerVersion /format:list
    3⤵
    PID:4184
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get SpecVersion /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get SpecVersion /format:list
    3⤵
    PID:1192
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$t=Get-Tpm;if(-not $t.TpmPresent){'Unavailable'}elseif($t.TpmPresent -and $t.TpmReady){'Enabled'}elseif($t.TpmPresent){'Disabled'}else{'Unavailable'}"
  2⤵
  - Executes a command shell one-liner
  PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$t=Get-Tpm;if(-not $t.TpmPresent){'Unavailable'}elseif($t.TpmPresent -and $t.TpmReady){'Enabled'}elseif($t.TpmPresent){'Disabled'}else{'Unavailable'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1576
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic cpu get Name /format:list
  2⤵
  - Executes a command shell one-liner
  PID:3740
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name /format:list
    3⤵
    PID:4812
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic path win32_networkadapter get Name,AdapterTypeId,PNPDeviceID /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1084
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter get Name,AdapterTypeId,PNPDeviceID /format:list
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic baseboard get Manufacturer /format:list
  2⤵
  - Executes a command shell one-liner
  PID:2060
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic diskdrive get model,serialnumber /format:csv
  2⤵
  - Executes a command shell one-liner
  PID:2952
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get model,serialnumber /format:csv
    3⤵
    PID:4760
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic cpu get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  PID:2444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber /format:list
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic bios get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1140
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber /format:list
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic baseboard get SerialNumber /format:list
  2⤵
  - Executes a command shell one-liner
  PID:4136
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber /format:list
    3⤵
    PID:4144
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c wmic path win32_computersystemproduct get UUID /format:list
  2⤵
  - Executes a command shell one-liner
  PID:1964
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get UUID /format:list
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$h=(Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256).PublicKeyHash;if($h){$h}"
  2⤵
  - Executes a command shell one-liner
  PID:2160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue';$h=(Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256).PublicKeyHash;if($h){$h}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\amigendrv64.sys
C:\Users\Admin\AppData\Local\Temp\obseswieeMem_0E5AA3A4_4964\amidewin\amigendrv64.sys
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...