43e08b529d8083a781d4cacc304aaa2513aaa689b9887820bf0eea813624152d

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Terentiy.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Terentiy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4788	cmd.exe
2380	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Terentiy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Terentiy.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BaseBoardManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Manufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BaseBoardProduct	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Model	Terentiy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemModel	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\Manufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Terentiy.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240652031.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240654671.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240658562.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240659718.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240659328.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240653125.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240654015.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240656718.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240656718.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240654312.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240642875.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240656718.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240656875.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240658140.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240641031.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240642140.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240642140.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240647015.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240648109.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240659812.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240644218.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240645609.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240656875.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240658140.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240646125.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240651687.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240651921.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240654984.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240657843.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240659125.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240641250.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240654531.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240659046.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240641031.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240644625.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240646656.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240650406.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240653531.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240659328.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240645609.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240651781.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240654312.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240658953.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240659812.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240641031.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240648609.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240651921.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240653125.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240654531.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240658718.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240642640.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240651781.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240648609.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240654671.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240656718.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winupdate_240646125.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240646656.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240648609.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winupdate_240654984.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winupdate_240658046.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240659453.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winupdate_240654421.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winupdate_240659218.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32\ThreadingModel = "Apartment"	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ThreadingModel = "Apartment"	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\CLSID	Terentiy.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5076	schtasks.exe
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	taskmgr.exe
Token: SeSystemProfilePrivilege	3264	taskmgr.exe
Token: SeCreateGlobalPrivilege	3264	taskmgr.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2884	4840	Terentiy.exe	86
PID 1768 wrote to memory of 4788	1768	Terentiy.exe	87
PID 2884 wrote to memory of 456	2884	winupdate_240640703.exe	90
PID 456 wrote to memory of 4152	456	winupdate_240641031.exe	91
PID 4152 wrote to memory of 1032	4152	winupdate_240641250.exe	92
PID 4788 wrote to memory of 2888	4788	cmd.exe	93
PID 1768 wrote to memory of 2380	1768	Terentiy.exe	94
PID 1032 wrote to memory of 1472	1032	winupdate_240641515.exe	96
PID 1472 wrote to memory of 2052	1472	winupdate_240642140.exe	97
PID 2380 wrote to memory of 5076	2380	cmd.exe	209
PID 2052 wrote to memory of 2924	2052	winupdate_240642640.exe	99
PID 2924 wrote to memory of 3748	2924	winupdate_240642875.exe	100
PID 3748 wrote to memory of 2600	3748	winupdate_240644218.exe	101
PID 2600 wrote to memory of 4648	2600	winupdate_240644625.exe	102
PID 4648 wrote to memory of 4268	4648	winupdate_240645406.exe	103
PID 4268 wrote to memory of 4180	4268	winupdate_240645609.exe	104
PID 4180 wrote to memory of 4980	4180	winupdate_240646125.exe	105
PID 4980 wrote to memory of 4976	4980	winupdate_240646656.exe	106
PID 4976 wrote to memory of 4440	4976	winupdate_240647015.exe	107
PID 4440 wrote to memory of 3868	4440	winupdate_240647625.exe	108
PID 3868 wrote to memory of 216	3868	winupdate_240648109.exe	109
PID 216 wrote to memory of 2320	216	winupdate_240648609.exe	110
PID 2320 wrote to memory of 4136	2320	winupdate_240649515.exe	111
PID 4136 wrote to memory of 4420	4136	winupdate_240649984.exe	112
PID 4420 wrote to memory of 1128	4420	winupdate_240650406.exe	113
PID 1128 wrote to memory of 1108	1128	winupdate_240650531.exe	115
PID 1108 wrote to memory of 4092	1108	winupdate_240651687.exe	117
PID 4092 wrote to memory of 2304	4092	winupdate_240651781.exe	118
PID 2304 wrote to memory of 4516	2304	winupdate_240651921.exe	119
PID 4516 wrote to memory of 3684	4516	winupdate_240652031.exe	120
PID 3684 wrote to memory of 4424	3684	winupdate_240653125.exe	121
PID 4424 wrote to memory of 1676	4424	winupdate_240653531.exe	123
PID 1676 wrote to memory of 4316	1676	winupdate_240654015.exe	124
PID 4316 wrote to memory of 4828	4316	winupdate_240654312.exe	126
PID 4828 wrote to memory of 1544	4828	winupdate_240654421.exe	127
PID 1544 wrote to memory of 3912	1544	winupdate_240654531.exe	128
PID 3912 wrote to memory of 1532	3912	winupdate_240654671.exe	129
PID 1532 wrote to memory of 1796	1532	winupdate_240654984.exe	130
PID 1796 wrote to memory of 2276	1796	winupdate_240656718.exe	131
PID 2276 wrote to memory of 5084	2276	winupdate_240656875.exe	132
PID 5084 wrote to memory of 3296	5084	winupdate_240657843.exe	133
PID 3296 wrote to memory of 2880	3296	winupdate_240658046.exe	134
PID 2880 wrote to memory of 2804	2880	winupdate_240658140.exe	135
PID 2804 wrote to memory of 1860	2804	winupdate_240658406.exe	136
PID 1860 wrote to memory of 1620	1860	winupdate_240658562.exe	137
PID 1620 wrote to memory of 1228	1620	winupdate_240658718.exe	138
PID 1228 wrote to memory of 5068	1228	winupdate_240658953.exe	139
PID 5068 wrote to memory of 560	5068	winupdate_240659046.exe	140
PID 560 wrote to memory of 1148	560	winupdate_240659125.exe	141
PID 1148 wrote to memory of 212	1148	winupdate_240659218.exe	142
PID 212 wrote to memory of 2956	212	winupdate_240659328.exe	143
PID 2956 wrote to memory of 4156	2956	winupdate_240659453.exe	144
PID 4156 wrote to memory of 1648	4156	winupdate_240659531.exe	145
PID 1648 wrote to memory of 5024	1648	winupdate_240659625.exe	146
PID 5024 wrote to memory of 2704	5024	winupdate_240659718.exe	147
PID 2704 wrote to memory of 1528	2704	winupdate_240659812.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
"C:\Users\Admin\AppData\Local\Temp\Terentiy.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5076

C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Temp\winupdate_240640703.exe
  "C:\Windows\Temp\winupdate_240640703.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\Temp\winupdate_240641031.exe
    "C:\Windows\Temp\winupdate_240641031.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\Temp\winupdate_240641250.exe
      "C:\Windows\Temp\winupdate_240641250.exe"
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Windows\Temp\winupdate_240641515.exe
        
        "C:\Windows\Temp\winupdate_240641515.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1032
      - C:\Windows\Temp\winupdate_240642140.exe
        
        "C:\Windows\Temp\winupdate_240642140.exe"
        6⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\Temp\winupdate_240642640.exe
        
        "C:\Windows\Temp\winupdate_240642640.exe"
        7⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\Temp\winupdate_240642875.exe
        
        "C:\Windows\Temp\winupdate_240642875.exe"
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\Temp\winupdate_240644218.exe
        
        "C:\Windows\Temp\winupdate_240644218.exe"
        9⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\Temp\winupdate_240644625.exe
        
        "C:\Windows\Temp\winupdate_240644625.exe"
        10⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\Temp\winupdate_240645406.exe
        
        "C:\Windows\Temp\winupdate_240645406.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\Temp\winupdate_240645609.exe
        
        "C:\Windows\Temp\winupdate_240645609.exe"
        12⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\Temp\winupdate_240646125.exe
        
        "C:\Windows\Temp\winupdate_240646125.exe"
        13⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\Temp\winupdate_240646656.exe
        
        "C:\Windows\Temp\winupdate_240646656.exe"
        14⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\Temp\winupdate_240647015.exe
        
        "C:\Windows\Temp\winupdate_240647015.exe"
        15⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\Temp\winupdate_240647625.exe
        
        "C:\Windows\Temp\winupdate_240647625.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\Temp\winupdate_240648109.exe
        
        "C:\Windows\Temp\winupdate_240648109.exe"
        17⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\Temp\winupdate_240648609.exe
        
        "C:\Windows\Temp\winupdate_240648609.exe"
        18⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\Temp\winupdate_240649515.exe
        
        "C:\Windows\Temp\winupdate_240649515.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\Temp\winupdate_240649984.exe
        
        "C:\Windows\Temp\winupdate_240649984.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\Temp\winupdate_240650406.exe
        
        "C:\Windows\Temp\winupdate_240650406.exe"
        21⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\Temp\winupdate_240650531.exe
        
        "C:\Windows\Temp\winupdate_240650531.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\Temp\winupdate_240651687.exe
        
        "C:\Windows\Temp\winupdate_240651687.exe"
        23⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\Temp\winupdate_240651781.exe
        
        "C:\Windows\Temp\winupdate_240651781.exe"
        24⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\Temp\winupdate_240651921.exe
        
        "C:\Windows\Temp\winupdate_240651921.exe"
        25⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\Temp\winupdate_240652031.exe
        
        "C:\Windows\Temp\winupdate_240652031.exe"
        26⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\Temp\winupdate_240653125.exe
        
        "C:\Windows\Temp\winupdate_240653125.exe"
        27⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\Temp\winupdate_240653531.exe
        
        "C:\Windows\Temp\winupdate_240653531.exe"
        28⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\Temp\winupdate_240654015.exe
        
        "C:\Windows\Temp\winupdate_240654015.exe"
        29⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\Temp\winupdate_240654312.exe
        
        "C:\Windows\Temp\winupdate_240654312.exe"
        30⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\Temp\winupdate_240654421.exe
        
        "C:\Windows\Temp\winupdate_240654421.exe"
        31⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\Temp\winupdate_240654531.exe
        
        "C:\Windows\Temp\winupdate_240654531.exe"
        32⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\Temp\winupdate_240654671.exe
        
        "C:\Windows\Temp\winupdate_240654671.exe"
        33⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\Temp\winupdate_240654984.exe
        
        "C:\Windows\Temp\winupdate_240654984.exe"
        34⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\Temp\winupdate_240656718.exe
        
        "C:\Windows\Temp\winupdate_240656718.exe"
        35⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\Temp\winupdate_240656875.exe
        
        "C:\Windows\Temp\winupdate_240656875.exe"
        36⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\Temp\winupdate_240657843.exe
        
        "C:\Windows\Temp\winupdate_240657843.exe"
        37⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\Temp\winupdate_240658046.exe
        
        "C:\Windows\Temp\winupdate_240658046.exe"
        38⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\Temp\winupdate_240658140.exe
        
        "C:\Windows\Temp\winupdate_240658140.exe"
        39⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\Temp\winupdate_240658406.exe
        
        "C:\Windows\Temp\winupdate_240658406.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\Temp\winupdate_240658562.exe
        
        "C:\Windows\Temp\winupdate_240658562.exe"
        41⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\Temp\winupdate_240658718.exe
        
        "C:\Windows\Temp\winupdate_240658718.exe"
        42⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\Temp\winupdate_240658953.exe
        
        "C:\Windows\Temp\winupdate_240658953.exe"
        43⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\Temp\winupdate_240659046.exe
        
        "C:\Windows\Temp\winupdate_240659046.exe"
        44⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\Temp\winupdate_240659125.exe
        
        "C:\Windows\Temp\winupdate_240659125.exe"
        45⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\Temp\winupdate_240659218.exe
        
        "C:\Windows\Temp\winupdate_240659218.exe"
        46⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\Temp\winupdate_240659328.exe
        
        "C:\Windows\Temp\winupdate_240659328.exe"
        47⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\Temp\winupdate_240659453.exe
        
        "C:\Windows\Temp\winupdate_240659453.exe"
        48⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\Temp\winupdate_240659531.exe
        
        "C:\Windows\Temp\winupdate_240659531.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\Temp\winupdate_240659625.exe
        
        "C:\Windows\Temp\winupdate_240659625.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\Temp\winupdate_240659718.exe
        
        "C:\Windows\Temp\winupdate_240659718.exe"
        51⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\Temp\winupdate_240659812.exe
        
        "C:\Windows\Temp\winupdate_240659812.exe"
        52⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\Temp\winupdate_240659921.exe
        
        "C:\Windows\Temp\winupdate_240659921.exe"
        53⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\Temp\winupdate_240660015.exe
        
        "C:\Windows\Temp\winupdate_240660015.exe"
        54⤵
        
        PID:1188
        
        C:\Windows\Temp\winupdate_240660093.exe
        
        "C:\Windows\Temp\winupdate_240660093.exe"
        55⤵
        
        PID:544
        
        C:\Windows\Temp\winupdate_240660187.exe
        
        "C:\Windows\Temp\winupdate_240660187.exe"
        56⤵
        
        PID:4916
        
        C:\Windows\Temp\winupdate_240660296.exe
        
        "C:\Windows\Temp\winupdate_240660296.exe"
        57⤵
        
        PID:4460
        
        C:\Windows\Temp\winupdate_240660421.exe
        
        "C:\Windows\Temp\winupdate_240660421.exe"
        58⤵
        
        PID:4800
        
        C:\Windows\Temp\winupdate_240660515.exe
        
        "C:\Windows\Temp\winupdate_240660515.exe"
        59⤵
        
        PID:4036
        
        C:\Windows\Temp\winupdate_240660640.exe
        
        "C:\Windows\Temp\winupdate_240660640.exe"
        60⤵
        
        PID:4572
        
        C:\Windows\Temp\winupdate_240660734.exe
        
        "C:\Windows\Temp\winupdate_240660734.exe"
        61⤵
        
        PID:4868
        
        C:\Windows\Temp\winupdate_240660812.exe
        
        "C:\Windows\Temp\winupdate_240660812.exe"
        62⤵
        
        PID:2428
        
        C:\Windows\Temp\winupdate_240660906.exe
        
        "C:\Windows\Temp\winupdate_240660906.exe"
        63⤵
        
        PID:4644
        
        C:\Windows\Temp\winupdate_240661000.exe
        
        "C:\Windows\Temp\winupdate_240661000.exe"
        64⤵
        
        PID:3160
        
        C:\Windows\Temp\winupdate_240661078.exe
        
        "C:\Windows\Temp\winupdate_240661078.exe"
        65⤵
        
        PID:3252
        
        C:\Windows\Temp\winupdate_240661187.exe
        
        "C:\Windows\Temp\winupdate_240661187.exe"
        66⤵
        
        PID:4016
        
        C:\Windows\Temp\winupdate_240661296.exe
        
        "C:\Windows\Temp\winupdate_240661296.exe"
        67⤵
        
        PID:3852
        
        C:\Windows\Temp\winupdate_240661390.exe
        
        "C:\Windows\Temp\winupdate_240661390.exe"
        68⤵
        
        PID:4668
        
        C:\Windows\Temp\winupdate_240661500.exe
        
        "C:\Windows\Temp\winupdate_240661500.exe"
        69⤵
        
        PID:3504
        
        C:\Windows\Temp\winupdate_240661593.exe
        
        "C:\Windows\Temp\winupdate_240661593.exe"
        70⤵
        
        PID:3760
        
        C:\Windows\Temp\winupdate_240661703.exe
        
        "C:\Windows\Temp\winupdate_240661703.exe"
        71⤵
        
        PID:2408
        
        C:\Windows\Temp\winupdate_240661796.exe
        
        "C:\Windows\Temp\winupdate_240661796.exe"
        72⤵
        
        PID:4732
        
        C:\Windows\Temp\winupdate_240661906.exe
        
        "C:\Windows\Temp\winupdate_240661906.exe"
        73⤵
        
        PID:644
        
        C:\Windows\Temp\winupdate_240662000.exe
        
        "C:\Windows\Temp\winupdate_240662000.exe"
        74⤵
        
        PID:4284
        
        C:\Windows\Temp\winupdate_240662093.exe
        
        "C:\Windows\Temp\winupdate_240662093.exe"
        75⤵
        
        PID:4556
        
        C:\Windows\Temp\winupdate_240662187.exe
        
        "C:\Windows\Temp\winupdate_240662187.exe"
        76⤵
        
        PID:1756
        
        C:\Windows\Temp\winupdate_240662281.exe
        
        "C:\Windows\Temp\winupdate_240662281.exe"
        77⤵
        
        PID:3656
        
        C:\Windows\Temp\winupdate_240662375.exe
        
        "C:\Windows\Temp\winupdate_240662375.exe"
        78⤵
        
        PID:1740
        
        C:\Windows\Temp\winupdate_240662468.exe
        
        "C:\Windows\Temp\winupdate_240662468.exe"
        79⤵
        
        PID:4624
        
        C:\Windows\Temp\winupdate_240662546.exe
        
        "C:\Windows\Temp\winupdate_240662546.exe"
        80⤵
        
        PID:4004
        
        C:\Windows\Temp\winupdate_240662640.exe
        
        "C:\Windows\Temp\winupdate_240662640.exe"
        81⤵
        
        PID:3728
        
        C:\Windows\Temp\winupdate_240662718.exe
        
        "C:\Windows\Temp\winupdate_240662718.exe"
        82⤵
        
        PID:876
        
        C:\Windows\Temp\winupdate_240662812.exe
        
        "C:\Windows\Temp\winupdate_240662812.exe"
        83⤵
        
        PID:2664
        
        C:\Windows\Temp\winupdate_240662890.exe
        
        "C:\Windows\Temp\winupdate_240662890.exe"
        84⤵
        
        PID:724
        
        C:\Windows\Temp\winupdate_240662984.exe
        
        "C:\Windows\Temp\winupdate_240662984.exe"
        85⤵
        
        PID:2852
        
        C:\Windows\Temp\winupdate_240663093.exe
        
        "C:\Windows\Temp\winupdate_240663093.exe"
        86⤵
        
        PID:3780
        
        C:\Windows\Temp\winupdate_240663203.exe
        
        "C:\Windows\Temp\winupdate_240663203.exe"
        87⤵
        
        PID:4816
        
        C:\Windows\Temp\winupdate_240663312.exe
        
        "C:\Windows\Temp\winupdate_240663312.exe"
        88⤵
        
        PID:1888
        
        C:\Windows\Temp\winupdate_240663421.exe
        
        "C:\Windows\Temp\winupdate_240663421.exe"
        89⤵
        
        PID:3880
        
        C:\Windows\Temp\winupdate_240663515.exe
        
        "C:\Windows\Temp\winupdate_240663515.exe"
        90⤵
        
        PID:4144
        
        C:\Windows\Temp\winupdate_240663609.exe
        
        "C:\Windows\Temp\winupdate_240663609.exe"
        91⤵
        
        PID:4804
        
        C:\Windows\Temp\winupdate_240663703.exe
        
        "C:\Windows\Temp\winupdate_240663703.exe"
        92⤵
        
        PID:2084
        
        C:\Windows\Temp\winupdate_240663796.exe
        
        "C:\Windows\Temp\winupdate_240663796.exe"
        93⤵
        
        PID:3468
        
        C:\Windows\Temp\winupdate_240663890.exe
        
        "C:\Windows\Temp\winupdate_240663890.exe"
        94⤵
        
        PID:3116
        
        C:\Windows\Temp\winupdate_240663984.exe
        
        "C:\Windows\Temp\winupdate_240663984.exe"
        95⤵
        
        PID:2136
        
        C:\Windows\Temp\winupdate_240664078.exe
        
        "C:\Windows\Temp\winupdate_240664078.exe"
        96⤵
        
        PID:2404
        
        C:\Windows\Temp\winupdate_240664171.exe
        
        "C:\Windows\Temp\winupdate_240664171.exe"
        97⤵
        
        PID:2528
        
        C:\Windows\Temp\winupdate_240664265.exe
        
        "C:\Windows\Temp\winupdate_240664265.exe"
        98⤵
        
        PID:2764
        
        C:\Windows\Temp\winupdate_240664359.exe
        
        "C:\Windows\Temp\winupdate_240664359.exe"
        99⤵
        
        PID:236
        
        C:\Windows\Temp\winupdate_240664453.exe
        
        "C:\Windows\Temp\winupdate_240664453.exe"
        100⤵
        
        PID:1792
        
        C:\Windows\Temp\winupdate_240664546.exe
        
        "C:\Windows\Temp\winupdate_240664546.exe"
        101⤵
        
        PID:476
        
        C:\Windows\Temp\winupdate_240664640.exe
        
        "C:\Windows\Temp\winupdate_240664640.exe"
        102⤵
        
        PID:4216
        
        C:\Windows\Temp\winupdate_240664718.exe
        
        "C:\Windows\Temp\winupdate_240664718.exe"
        103⤵
        
        PID:4168
        
        C:\Windows\Temp\winupdate_240664843.exe
        
        "C:\Windows\Temp\winupdate_240664843.exe"
        104⤵
        
        PID:1068
        
        C:\Windows\Temp\winupdate_240664921.exe
        
        "C:\Windows\Temp\winupdate_240664921.exe"
        105⤵
        
        PID:3400
        
        C:\Windows\Temp\winupdate_240665015.exe
        
        "C:\Windows\Temp\winupdate_240665015.exe"
        106⤵
        
        PID:1132
        
        C:\Windows\Temp\winupdate_240665093.exe
        
        "C:\Windows\Temp\winupdate_240665093.exe"
        107⤵
        
        PID:4444
        
        C:\Windows\Temp\winupdate_240665187.exe
        
        "C:\Windows\Temp\winupdate_240665187.exe"
        108⤵
        
        PID:3648
        
        C:\Windows\Temp\winupdate_240665265.exe
        
        "C:\Windows\Temp\winupdate_240665265.exe"
        109⤵
        
        PID:2584
        
        C:\Windows\Temp\winupdate_240665359.exe
        
        "C:\Windows\Temp\winupdate_240665359.exe"
        110⤵
        
        PID:3308
        
        C:\Windows\Temp\winupdate_240665453.exe
        
        "C:\Windows\Temp\winupdate_240665453.exe"
        111⤵
        
        PID:392
        
        C:\Windows\Temp\winupdate_240665531.exe
        
        "C:\Windows\Temp\winupdate_240665531.exe"
        112⤵
        
        PID:4820
        
        C:\Windows\Temp\winupdate_240665625.exe
        
        "C:\Windows\Temp\winupdate_240665625.exe"
        113⤵
        
        PID:3916
        
        C:\Windows\Temp\winupdate_240665718.exe
        
        "C:\Windows\Temp\winupdate_240665718.exe"
        114⤵
        
        PID:5076
        
        C:\Windows\Temp\winupdate_240665843.exe
        
        "C:\Windows\Temp\winupdate_240665843.exe"
        115⤵
        
        PID:3484
        
        C:\Windows\Temp\winupdate_240665937.exe
        
        "C:\Windows\Temp\winupdate_240665937.exe"
        116⤵
        
        PID:388
        
        C:\Windows\Temp\winupdate_240666015.exe
        
        "C:\Windows\Temp\winupdate_240666015.exe"
        117⤵
        
        PID:3488
        
        C:\Windows\Temp\winupdate_240666109.exe
        
        "C:\Windows\Temp\winupdate_240666109.exe"
        118⤵
        
        PID:4056
        
        C:\Windows\Temp\winupdate_240666203.exe
        
        "C:\Windows\Temp\winupdate_240666203.exe"
        119⤵
        
        PID:4164
        
        C:\Windows\Temp\winupdate_240666296.exe
        
        "C:\Windows\Temp\winupdate_240666296.exe"
        120⤵
        
        PID:4116
        
        C:\Windows\Temp\winupdate_240666375.exe
        
        "C:\Windows\Temp\winupdate_240666375.exe"
        121⤵
        
        PID:4952
        
        C:\Windows\Temp\winupdate_240666484.exe
        
        "C:\Windows\Temp\winupdate_240666484.exe"
        122⤵
        
        PID:116
        
        C:\Windows\Temp\winupdate_240666562.exe
        
        "C:\Windows\Temp\winupdate_240666562.exe"
        123⤵
        
        PID:3436
        
        C:\Windows\Temp\winupdate_240666671.exe
        
        "C:\Windows\Temp\winupdate_240666671.exe"
        124⤵
        
        PID:4500
        
        C:\Windows\Temp\winupdate_240666781.exe
        
        "C:\Windows\Temp\winupdate_240666781.exe"
        125⤵
        
        PID:2268
        
        C:\Windows\Temp\winupdate_240666890.exe
        
        "C:\Windows\Temp\winupdate_240666890.exe"
        126⤵
        
        PID:2328
        
        C:\Windows\Temp\winupdate_240667000.exe
        
        "C:\Windows\Temp\winupdate_240667000.exe"
        127⤵
        
        PID:2152
        
        C:\Windows\Temp\winupdate_240667093.exe
        
        "C:\Windows\Temp\winupdate_240667093.exe"
        128⤵
        
        PID:2340
        
        C:\Windows\Temp\winupdate_240667187.exe
        
        "C:\Windows\Temp\winupdate_240667187.exe"
        129⤵
        
        PID:4272
        
        C:\Windows\Temp\winupdate_240667281.exe
        
        "C:\Windows\Temp\winupdate_240667281.exe"
        130⤵
        
        PID:3444
        
        C:\Windows\Temp\winupdate_240667390.exe
        
        "C:\Windows\Temp\winupdate_240667390.exe"
        131⤵
        
        PID:2336
        
        C:\Windows\Temp\winupdate_240667500.exe
        
        "C:\Windows\Temp\winupdate_240667500.exe"
        132⤵
        
        PID:2332
        
        C:\Windows\Temp\winupdate_240667609.exe
        
        "C:\Windows\Temp\winupdate_240667609.exe"
        133⤵
        
        PID:3076
        
        C:\Windows\Temp\winupdate_240667703.exe
        
        "C:\Windows\Temp\winupdate_240667703.exe"
        134⤵
        
        PID:2212
        
        C:\Windows\Temp\winupdate_240667796.exe
        
        "C:\Windows\Temp\winupdate_240667796.exe"
        135⤵
        
        PID:2116
        
        C:\Windows\Temp\winupdate_240667906.exe
        
        "C:\Windows\Temp\winupdate_240667906.exe"
        136⤵
        
        PID:1896
        
        C:\Windows\Temp\winupdate_240668000.exe
        
        "C:\Windows\Temp\winupdate_240668000.exe"
        137⤵
        
        PID:2416
        
        C:\Windows\Temp\winupdate_240668078.exe
        
        "C:\Windows\Temp\winupdate_240668078.exe"
        138⤵
        
        PID:1804
        
        C:\Windows\Temp\winupdate_240668187.exe
        
        "C:\Windows\Temp\winupdate_240668187.exe"
        139⤵
        
        PID:776
        
        C:\Windows\Temp\winupdate_240668281.exe
        
        "C:\Windows\Temp\winupdate_240668281.exe"
        140⤵
        
        PID:4600
        
        C:\Windows\Temp\winupdate_240668375.exe
        
        "C:\Windows\Temp\winupdate_240668375.exe"
        141⤵
        
        PID:4912
        
        C:\Windows\Temp\winupdate_240668468.exe
        
        "C:\Windows\Temp\winupdate_240668468.exe"
        142⤵
        
        PID:4372
        
        C:\Windows\Temp\winupdate_240668765.exe
        
        "C:\Windows\Temp\winupdate_240668765.exe"
        143⤵
        
        PID:2204
        
        C:\Windows\Temp\winupdate_240669015.exe
        
        "C:\Windows\Temp\winupdate_240669015.exe"
        144⤵
        
        PID:1640
        
        C:\Windows\Temp\winupdate_240669093.exe
        
        "C:\Windows\Temp\winupdate_240669093.exe"
        145⤵
        
        PID:2396
        
        C:\Windows\Temp\winupdate_240669218.exe
        
        "C:\Windows\Temp\winupdate_240669218.exe"
        146⤵
        
        PID:708
        
        C:\Windows\Temp\winupdate_240669312.exe
        
        "C:\Windows\Temp\winupdate_240669312.exe"
        147⤵
        
        PID:4404
        
        C:\Windows\Temp\winupdate_240669437.exe
        
        "C:\Windows\Temp\winupdate_240669437.exe"
        148⤵
        
        PID:2100
        
        C:\Windows\Temp\winupdate_240669515.exe
        
        "C:\Windows\Temp\winupdate_240669515.exe"
        149⤵
        
        PID:3416
        
        C:\Windows\Temp\winupdate_240669656.exe
        
        "C:\Windows\Temp\winupdate_240669656.exe"
        150⤵
        
        PID:4540
        
        C:\Windows\Temp\winupdate_240669796.exe
        
        "C:\Windows\Temp\winupdate_240669796.exe"
        151⤵
        
        PID:2312
        
        C:\Windows\Temp\winupdate_240670031.exe
        
        "C:\Windows\Temp\winupdate_240670031.exe"
        152⤵
        
        PID:4324
        
        C:\Windows\Temp\winupdate_240670250.exe
        
        "C:\Windows\Temp\winupdate_240670250.exe"
        153⤵
        
        PID:8
        
        C:\Windows\Temp\winupdate_240670343.exe
        
        "C:\Windows\Temp\winupdate_240670343.exe"
        154⤵
        
        PID:4960
        
        C:\Windows\Temp\winupdate_240670453.exe
        
        "C:\Windows\Temp\winupdate_240670453.exe"
        155⤵
        
        PID:4888
        
        C:\Windows\Temp\winupdate_240670578.exe
        
        "C:\Windows\Temp\winupdate_240670578.exe"
        156⤵
        
        PID:2996
        
        C:\Windows\Temp\winupdate_240670656.exe
        
        "C:\Windows\Temp\winupdate_240670656.exe"
        157⤵
        
        PID:3284
        
        C:\Windows\Temp\winupdate_240670765.exe
        
        "C:\Windows\Temp\winupdate_240670765.exe"
        158⤵
        
        PID:1456
        
        C:\Windows\Temp\winupdate_240670859.exe
        
        "C:\Windows\Temp\winupdate_240670859.exe"
        159⤵
        
        PID:4900
        
        C:\Windows\Temp\winupdate_240670968.exe
        
        "C:\Windows\Temp\winupdate_240670968.exe"
        160⤵
        
        PID:4824
        
        C:\Windows\Temp\winupdate_240671046.exe
        
        "C:\Windows\Temp\winupdate_240671046.exe"
        161⤵
        
        PID:2000
        
        C:\Windows\Temp\winupdate_240671125.exe
        
        "C:\Windows\Temp\winupdate_240671125.exe"
        162⤵
        
        PID:812
        
        C:\Windows\Temp\winupdate_240671250.exe
        
        "C:\Windows\Temp\winupdate_240671250.exe"
        163⤵
        
        PID:3772
        
        C:\Windows\Temp\winupdate_240671390.exe
        
        "C:\Windows\Temp\winupdate_240671390.exe"
        164⤵
        
        PID:4260
        
        C:\Windows\Temp\winupdate_240671609.exe
        
        "C:\Windows\Temp\winupdate_240671609.exe"
        165⤵
        
        PID:1752
        
        C:\Windows\Temp\winupdate_240671875.exe
        
        "C:\Windows\Temp\winupdate_240671875.exe"
        166⤵
        
        PID:4228
        
        C:\Windows\Temp\winupdate_240672015.exe
        
        "C:\Windows\Temp\winupdate_240672015.exe"
        167⤵
        
        PID:3364
        
        C:\Windows\Temp\winupdate_240672109.exe
        
        "C:\Windows\Temp\winupdate_240672109.exe"
        168⤵
        
        PID:1864
        
        C:\Windows\Temp\winupdate_240672234.exe
        
        "C:\Windows\Temp\winupdate_240672234.exe"
        169⤵
        
        PID:2040
        
        C:\Windows\Temp\winupdate_240672375.exe
        
        "C:\Windows\Temp\winupdate_240672375.exe"
        170⤵
        
        PID:1692
        
        C:\Windows\Temp\winupdate_240672531.exe
        
        "C:\Windows\Temp\winupdate_240672531.exe"
        171⤵
        
        PID:4716
        
        C:\Windows\Temp\winupdate_240672656.exe
        
        "C:\Windows\Temp\winupdate_240672656.exe"
        172⤵
        
        PID:2280
        
        C:\Windows\Temp\winupdate_240672781.exe
        
        "C:\Windows\Temp\winupdate_240672781.exe"
        173⤵
        
        PID:4172
        
        C:\Windows\Temp\winupdate_240672890.exe
        
        "C:\Windows\Temp\winupdate_240672890.exe"
        174⤵
        
        PID:220
        
        C:\Windows\Temp\winupdate_240673140.exe
        
        "C:\Windows\Temp\winupdate_240673140.exe"
        175⤵
        
        PID:4536
        
        C:\Windows\Temp\winupdate_240673250.exe
        
        "C:\Windows\Temp\winupdate_240673250.exe"
        176⤵
        
        PID:3356
        
        C:\Windows\Temp\winupdate_240673468.exe
        
        "C:\Windows\Temp\winupdate_240673468.exe"
        177⤵
        
        PID:4244
        
        C:\Windows\Temp\winupdate_240673609.exe
        
        "C:\Windows\Temp\winupdate_240673609.exe"
        178⤵
        
        PID:4700
        
        C:\Windows\Temp\winupdate_240673796.exe
        
        "C:\Windows\Temp\winupdate_240673796.exe"
        179⤵
        
        PID:3020
        
        C:\Windows\Temp\winupdate_240673984.exe
        
        "C:\Windows\Temp\winupdate_240673984.exe"
        180⤵
        
        PID:744
        
        C:\Windows\Temp\winupdate_240674109.exe
        
        "C:\Windows\Temp\winupdate_240674109.exe"
        181⤵
        
        PID:1988
        
        C:\Windows\Temp\winupdate_240674359.exe
        
        "C:\Windows\Temp\winupdate_240674359.exe"
        182⤵
        
        PID:5072
        
        C:\Windows\Temp\winupdate_240674515.exe
        
        "C:\Windows\Temp\winupdate_240674515.exe"
        183⤵
        
        PID:4012
        
        C:\Windows\Temp\winupdate_240674671.exe
        
        "C:\Windows\Temp\winupdate_240674671.exe"
        184⤵
        
        PID:4772
        
        C:\Windows\Temp\winupdate_240674812.exe
        
        "C:\Windows\Temp\winupdate_240674812.exe"
        185⤵
        
        PID:2364
        
        C:\Windows\Temp\winupdate_240675000.exe
        
        "C:\Windows\Temp\winupdate_240675000.exe"
        186⤵
        
        PID:2120
        
        C:\Windows\Temp\winupdate_240675250.exe
        
        "C:\Windows\Temp\winupdate_240675250.exe"
        187⤵
        
        PID:5092
        
        C:\Windows\Temp\winupdate_240675578.exe
        
        "C:\Windows\Temp\winupdate_240675578.exe"
        188⤵
        
        PID:4532
        
        C:\Windows\Temp\winupdate_240675656.exe
        
        "C:\Windows\Temp\winupdate_240675656.exe"
        189⤵
        
        PID:408
        
        C:\Windows\Temp\winupdate_240675796.exe
        
        "C:\Windows\Temp\winupdate_240675796.exe"
        190⤵
        
        PID:4792
        
        C:\Windows\Temp\winupdate_240676015.exe
        
        "C:\Windows\Temp\winupdate_240676015.exe"
        191⤵
        
        PID:1448
        
        C:\Windows\Temp\winupdate_240676281.exe
        
        "C:\Windows\Temp\winupdate_240676281.exe"
        192⤵
        
        PID:2964
        
        C:\Windows\Temp\winupdate_240676453.exe
        
        "C:\Windows\Temp\winupdate_240676453.exe"
        193⤵
        
        PID:2812
        
        C:\Windows\Temp\winupdate_240676718.exe
        
        "C:\Windows\Temp\winupdate_240676718.exe"
        194⤵
        
        PID:3604
        
        C:\Windows\Temp\winupdate_240676843.exe
        
        "C:\Windows\Temp\winupdate_240676843.exe"
        195⤵
        
        PID:1176
        
        C:\Windows\Temp\winupdate_240677015.exe
        
        "C:\Windows\Temp\winupdate_240677015.exe"
        196⤵
        
        PID:4320
        
        C:\Windows\Temp\winupdate_240677296.exe
        
        "C:\Windows\Temp\winupdate_240677296.exe"
        197⤵
        
        PID:4044
        
        C:\Windows\Temp\winupdate_240677656.exe
        
        "C:\Windows\Temp\winupdate_240677656.exe"
        198⤵
        
        PID:3856
        
        C:\Windows\Temp\winupdate_240677796.exe
        
        "C:\Windows\Temp\winupdate_240677796.exe"
        199⤵
        
        PID:1788
        
        C:\Windows\Temp\winupdate_240678046.exe
        
        "C:\Windows\Temp\winupdate_240678046.exe"
        200⤵
        
        PID:3520
        
        C:\Windows\Temp\winupdate_240678234.exe
        
        "C:\Windows\Temp\winupdate_240678234.exe"
        201⤵
        
        PID:1192
        
        C:\Windows\Temp\winupdate_240678578.exe
        
        "C:\Windows\Temp\winupdate_240678578.exe"
        202⤵
        
        PID:4996
        
        C:\Windows\Temp\winupdate_240678781.exe
        
        "C:\Windows\Temp\winupdate_240678781.exe"
        203⤵
        
        PID:4008
        
        C:\Windows\Temp\winupdate_240678906.exe
        
        "C:\Windows\Temp\winupdate_240678906.exe"
        204⤵
        
        PID:4348
        
        C:\Windows\Temp\winupdate_240679156.exe
        
        "C:\Windows\Temp\winupdate_240679156.exe"
        205⤵
        
        PID:1028
        
        C:\Windows\Temp\winupdate_240679250.exe
        
        "C:\Windows\Temp\winupdate_240679250.exe"
        206⤵
        
        PID:1976
        
        C:\Windows\Temp\winupdate_240679531.exe
        
        "C:\Windows\Temp\winupdate_240679531.exe"
        207⤵
        
        PID:420
        
        C:\Windows\Temp\winupdate_240679671.exe
        
        "C:\Windows\Temp\winupdate_240679671.exe"
        208⤵
        
        PID:2144
        
        C:\Windows\Temp\winupdate_240679859.exe
        
        "C:\Windows\Temp\winupdate_240679859.exe"
        209⤵
        
        PID:4808
        
        C:\Windows\Temp\winupdate_240679937.exe
        
        "C:\Windows\Temp\winupdate_240679937.exe"
        210⤵
        
        PID:4508
        
        C:\Windows\Temp\winupdate_240680031.exe
        
        "C:\Windows\Temp\winupdate_240680031.exe"
        211⤵
        
        PID:2456
        
        C:\Windows\Temp\winupdate_240680156.exe
        
        "C:\Windows\Temp\winupdate_240680156.exe"
        212⤵
        
        PID:4392
        
        C:\Windows\Temp\winupdate_240680312.exe
        
        "C:\Windows\Temp\winupdate_240680312.exe"
        213⤵
        
        PID:3968
        
        C:\Windows\Temp\winupdate_240680500.exe
        
        "C:\Windows\Temp\winupdate_240680500.exe"
        214⤵
        
        PID:1112
        
        C:\Windows\Temp\winupdate_240680625.exe
        
        "C:\Windows\Temp\winupdate_240680625.exe"
        215⤵
        
        PID:2960
        
        C:\Windows\Temp\winupdate_240680796.exe
        
        "C:\Windows\Temp\winupdate_240680796.exe"
        216⤵
        
        PID:3696
        
        C:\Windows\Temp\winupdate_240681078.exe
        
        "C:\Windows\Temp\winupdate_240681078.exe"
        217⤵
        
        PID:2460
        
        C:\Windows\Temp\winupdate_240681250.exe
        
        "C:\Windows\Temp\winupdate_240681250.exe"
        218⤵
        
        PID:4472
        
        C:\Windows\Temp\winupdate_240681406.exe
        
        "C:\Windows\Temp\winupdate_240681406.exe"
        219⤵
        
        PID:4232
        
        C:\Windows\Temp\winupdate_240681625.exe
        
        "C:\Windows\Temp\winupdate_240681625.exe"
        220⤵
        
        PID:872
        
        C:\Windows\Temp\winupdate_240681812.exe
        
        "C:\Windows\Temp\winupdate_240681812.exe"
        221⤵
        
        PID:816
        
        C:\Windows\Temp\winupdate_240681984.exe
        
        "C:\Windows\Temp\winupdate_240681984.exe"
        222⤵
        
        PID:3700
        
        C:\Windows\Temp\winupdate_240682078.exe
        
        "C:\Windows\Temp\winupdate_240682078.exe"
        223⤵
        
        PID:3584
        
        C:\Windows\Temp\winupdate_240682203.exe
        
        "C:\Windows\Temp\winupdate_240682203.exe"
        224⤵
        
        PID:4988
        
        C:\Windows\Temp\winupdate_240682375.exe
        
        "C:\Windows\Temp\winupdate_240682375.exe"
        225⤵
        
        PID:3368
        
        C:\Windows\Temp\winupdate_240682484.exe
        
        "C:\Windows\Temp\winupdate_240682484.exe"
        226⤵
        
        PID:1012
        
        C:\Windows\Temp\winupdate_240682687.exe
        
        "C:\Windows\Temp\winupdate_240682687.exe"
        227⤵
        
        PID:4280
        
        C:\Windows\Temp\winupdate_240682812.exe
        
        "C:\Windows\Temp\winupdate_240682812.exe"
        228⤵
        
        PID:1208
        
        C:\Windows\Temp\winupdate_240682953.exe
        
        "C:\Windows\Temp\winupdate_240682953.exe"
        229⤵
        
        PID:4188
        
        C:\Windows\Temp\winupdate_240683125.exe
        
        "C:\Windows\Temp\winupdate_240683125.exe"
        230⤵
        
        PID:1508
        
        C:\Windows\Temp\winupdate_240683265.exe
        
        "C:\Windows\Temp\winupdate_240683265.exe"
        231⤵
        
        PID:4720
        
        C:\Windows\Temp\winupdate_240683578.exe
        
        "C:\Windows\Temp\winupdate_240683578.exe"
        232⤵
        
        PID:4368
        
        C:\Windows\Temp\winupdate_240683718.exe
        
        "C:\Windows\Temp\winupdate_240683718.exe"
        233⤵
        
        PID:2684
        
        C:\Windows\Temp\winupdate_240683921.exe
        
        "C:\Windows\Temp\winupdate_240683921.exe"
        234⤵
        
        PID:4196
        
        C:\Windows\Temp\winupdate_240684109.exe
        
        "C:\Windows\Temp\winupdate_240684109.exe"
        235⤵
        
        PID:3412
        
        C:\Windows\Temp\winupdate_240684203.exe
        
        "C:\Windows\Temp\winupdate_240684203.exe"
        236⤵
        
        PID:1452
        
        C:\Windows\Temp\winupdate_240684312.exe
        
        "C:\Windows\Temp\winupdate_240684312.exe"
        237⤵
        
        PID:1720
        
        C:\Windows\Temp\winupdate_240684421.exe
        
        "C:\Windows\Temp\winupdate_240684421.exe"
        238⤵
        
        PID:1444
        
        C:\Windows\Temp\winupdate_240684562.exe
        
        "C:\Windows\Temp\winupdate_240684562.exe"
        239⤵
        
        PID:1600
        
        C:\Windows\Temp\winupdate_240684656.exe
        
        "C:\Windows\Temp\winupdate_240684656.exe"
        240⤵
        
        PID:2388
        
        C:\Windows\Temp\winupdate_240684750.exe
        
        "C:\Windows\Temp\winupdate_240684750.exe"
        241⤵
        
        PID:4656
        
        C:\Windows\Temp\winupdate_240684906.exe
        
        "C:\Windows\Temp\winupdate_240684906.exe"
        242⤵
        
        PID:556
        
        C:\Windows\Temp\winupdate_240684984.exe
        
        "C:\Windows\Temp\winupdate_240684984.exe"
        243⤵
        
        PID:4264
        
        C:\Windows\Temp\winupdate_240685093.exe
        
        "C:\Windows\Temp\winupdate_240685093.exe"
        244⤵
        
        PID:4796
        
        C:\Windows\Temp\winupdate_240685218.exe
        
        "C:\Windows\Temp\winupdate_240685218.exe"
        245⤵
        
        PID:3860
        
        C:\Windows\Temp\winupdate_240685343.exe
        
        "C:\Windows\Temp\winupdate_240685343.exe"
        246⤵
        
        PID:4192
        
        C:\Windows\Temp\winupdate_240685484.exe
        
        "C:\Windows\Temp\winupdate_240685484.exe"
        247⤵
        
        PID:4448
        
        C:\Windows\Temp\winupdate_240685593.exe
        
        "C:\Windows\Temp\winupdate_240685593.exe"
        248⤵
        
        PID:2832
        
        C:\Windows\Temp\winupdate_240685703.exe
        
        "C:\Windows\Temp\winupdate_240685703.exe"
        249⤵
        
        PID:1984
        
        C:\Windows\Temp\winupdate_240685828.exe
        
        "C:\Windows\Temp\winupdate_240685828.exe"
        250⤵
        
        PID:4396
        
        C:\Windows\Temp\winupdate_240685968.exe
        
        "C:\Windows\Temp\winupdate_240685968.exe"
        251⤵
        
        PID:3304
        
        C:\Windows\Temp\winupdate_240686156.exe
        
        "C:\Windows\Temp\winupdate_240686156.exe"
        252⤵
        
        PID:3820
        
        C:\Windows\Temp\winupdate_240686312.exe
        
        "C:\Windows\Temp\winupdate_240686312.exe"
        253⤵
        
        PID:1980
        
        C:\Windows\Temp\winupdate_240686453.exe
        
        "C:\Windows\Temp\winupdate_240686453.exe"
        254⤵
        
        PID:2232
        
        C:\Windows\Temp\winupdate_240686562.exe
        
        "C:\Windows\Temp\winupdate_240686562.exe"
        255⤵
        
        PID:5108
        
        C:\Windows\Temp\winupdate_240686671.exe
        
        "C:\Windows\Temp\winupdate_240686671.exe"
        256⤵
        
        PID:4276
        
        C:\Windows\Temp\winupdate_240686781.exe
        
        "C:\Windows\Temp\winupdate_240686781.exe"
        257⤵
        
        PID:1364
        
        C:\Windows\Temp\winupdate_240686890.exe
        
        "C:\Windows\Temp\winupdate_240686890.exe"
        258⤵
        
        PID:728
        
        C:\Windows\Temp\winupdate_240687015.exe
        
        "C:\Windows\Temp\winupdate_240687015.exe"
        259⤵
        
        PID:1160
        
        C:\Windows\Temp\winupdate_240687171.exe
        
        "C:\Windows\Temp\winupdate_240687171.exe"
        260⤵
        
        PID:5036
        
        C:\Windows\Temp\winupdate_240687250.exe
        
        "C:\Windows\Temp\winupdate_240687250.exe"
        261⤵
        
        PID:5100
        
        C:\Windows\Temp\winupdate_240687390.exe
        
        "C:\Windows\Temp\winupdate_240687390.exe"
        262⤵
        
        PID:1464
        
        C:\Windows\Temp\winupdate_240687500.exe
        
        "C:\Windows\Temp\winupdate_240687500.exe"
        263⤵
        
        PID:548
        
        C:\Windows\Temp\winupdate_240687625.exe
        
        "C:\Windows\Temp\winupdate_240687625.exe"
        264⤵
        
        PID:1748
        
        C:\Windows\Temp\winupdate_240687765.exe
        
        "C:\Windows\Temp\winupdate_240687765.exe"
        265⤵
        
        PID:4524
        
        C:\Windows\Temp\winupdate_240687843.exe
        
        "C:\Windows\Temp\winupdate_240687843.exe"
        266⤵
        
        PID:3000
        
        C:\Windows\Temp\winupdate_240688015.exe
        
        "C:\Windows\Temp\winupdate_240688015.exe"
        267⤵
        
        PID:2892
        
        C:\Windows\Temp\winupdate_240688125.exe
        
        "C:\Windows\Temp\winupdate_240688125.exe"
        268⤵
        
        PID:5048
        
        C:\Windows\Temp\winupdate_240688296.exe
        
        "C:\Windows\Temp\winupdate_240688296.exe"
        269⤵
        
        PID:3180
        
        C:\Windows\Temp\winupdate_240688468.exe
        
        "C:\Windows\Temp\winupdate_240688468.exe"
        270⤵
        
        PID:3240
        
        C:\Windows\Temp\winupdate_240688656.exe
        
        "C:\Windows\Temp\winupdate_240688656.exe"
        271⤵
        
        PID:3948
        
        C:\Windows\Temp\winupdate_240688796.exe
        
        "C:\Windows\Temp\winupdate_240688796.exe"
        272⤵
        
        PID:4456
        
        C:\Windows\Temp\winupdate_240688937.exe
        
        "C:\Windows\Temp\winupdate_240688937.exe"
        273⤵
        
        PID:2492
        
        C:\Windows\Temp\winupdate_240689140.exe
        
        "C:\Windows\Temp\winupdate_240689140.exe"
        274⤵
        
        PID:1440
        
        C:\Windows\Temp\winupdate_240689328.exe
        
        "C:\Windows\Temp\winupdate_240689328.exe"
        275⤵
        
        PID:1536
        
        C:\Windows\Temp\winupdate_240689421.exe
        
        "C:\Windows\Temp\winupdate_240689421.exe"
        276⤵
        
        PID:1852
        
        C:\Windows\Temp\winupdate_240689531.exe
        
        "C:\Windows\Temp\winupdate_240689531.exe"
        277⤵
        
        PID:1480
        
        C:\Windows\Temp\winupdate_240689718.exe
        
        "C:\Windows\Temp\winupdate_240689718.exe"
        278⤵
        
        PID:2168
        
        C:\Windows\Temp\winupdate_240689828.exe
        
        "C:\Windows\Temp\winupdate_240689828.exe"
        279⤵
        
        PID:4020
        
        C:\Windows\Temp\winupdate_240690000.exe
        
        "C:\Windows\Temp\winupdate_240690000.exe"
        280⤵
        
        PID:1036
        
        C:\Windows\Temp\winupdate_240690109.exe
        
        "C:\Windows\Temp\winupdate_240690109.exe"
        281⤵
        
        PID:3932
        
        C:\Windows\Temp\winupdate_240690250.exe
        
        "C:\Windows\Temp\winupdate_240690250.exe"
        282⤵
        
        PID:2632
        
        C:\Windows\Temp\winupdate_240690421.exe
        
        "C:\Windows\Temp\winupdate_240690421.exe"
        283⤵
        
        PID:4040
        
        C:\Windows\Temp\winupdate_240690531.exe
        
        "C:\Windows\Temp\winupdate_240690531.exe"
        284⤵
        
        PID:3540
        
        C:\Windows\Temp\winupdate_240690656.exe
        
        "C:\Windows\Temp\winupdate_240690656.exe"
        285⤵
        
        PID:2444
        
        C:\Windows\Temp\winupdate_240690843.exe
        
        "C:\Windows\Temp\winupdate_240690843.exe"
        286⤵
        
        PID:3736
        
        C:\Windows\Temp\winupdate_240690937.exe
        
        "C:\Windows\Temp\winupdate_240690937.exe"
        287⤵
        
        PID:2140
        
        C:\Windows\Temp\winupdate_240691062.exe
        
        "C:\Windows\Temp\winupdate_240691062.exe"
        288⤵
        
        PID:4584
        
        C:\Windows\Temp\winupdate_240691218.exe
        
        "C:\Windows\Temp\winupdate_240691218.exe"
        289⤵
        
        PID:2968
        
        C:\Windows\Temp\winupdate_240691343.exe
        
        "C:\Windows\Temp\winupdate_240691343.exe"
        290⤵
        
        PID:3100
        
        C:\Windows\Temp\winupdate_240691468.exe
        
        "C:\Windows\Temp\winupdate_240691468.exe"
        291⤵
        
        PID:1168
        
        C:\Windows\Temp\winupdate_240691578.exe
        
        "C:\Windows\Temp\winupdate_240691578.exe"
        292⤵
        
        PID:3768
        
        C:\Windows\Temp\winupdate_240691687.exe
        
        "C:\Windows\Temp\winupdate_240691687.exe"
        293⤵
        
        PID:1272
        
        C:\Windows\Temp\winupdate_240691828.exe
        
        "C:\Windows\Temp\winupdate_240691828.exe"
        294⤵
        
        PID:3324
        
        C:\Windows\Temp\winupdate_240691953.exe
        
        "C:\Windows\Temp\winupdate_240691953.exe"
        295⤵
        
        PID:4128
        
        C:\Windows\Temp\winupdate_240692046.exe
        
        "C:\Windows\Temp\winupdate_240692046.exe"
        296⤵
        
        PID:2928
        
        C:\Windows\Temp\winupdate_240692156.exe
        
        "C:\Windows\Temp\winupdate_240692156.exe"
        297⤵
        
        PID:868
        
        C:\Windows\Temp\winupdate_240692250.exe
        
        "C:\Windows\Temp\winupdate_240692250.exe"
        298⤵
        
        PID:4332
        
        C:\Windows\Temp\winupdate_240692375.exe
        
        "C:\Windows\Temp\winupdate_240692375.exe"
        299⤵
        
        PID:1180
        
        C:\Windows\Temp\winupdate_240692515.exe
        
        "C:\Windows\Temp\winupdate_240692515.exe"
        300⤵
        
        PID:4296
        
        C:\Windows\Temp\winupdate_240692687.exe
        
        "C:\Windows\Temp\winupdate_240692687.exe"
        301⤵
        
        PID:2652
        
        C:\Windows\Temp\winupdate_240692812.exe
        
        "C:\Windows\Temp\winupdate_240692812.exe"
        302⤵
        
        PID:3688
        
        C:\Windows\Temp\winupdate_240692937.exe
        
        "C:\Windows\Temp\winupdate_240692937.exe"
        303⤵
        
        PID:564
        
        C:\Windows\Temp\winupdate_240693046.exe
        
        "C:\Windows\Temp\winupdate_240693046.exe"
        304⤵
        
        PID:2160
        
        C:\Windows\Temp\winupdate_240693171.exe
        
        "C:\Windows\Temp\winupdate_240693171.exe"
        305⤵
        
        PID:4336
        
        C:\Windows\Temp\winupdate_240693281.exe
        
        "C:\Windows\Temp\winupdate_240693281.exe"
        306⤵
        
        PID:2860
        
        C:\Windows\Temp\winupdate_240693421.exe
        
        "C:\Windows\Temp\winupdate_240693421.exe"
        307⤵
        
        PID:2784
        
        C:\Windows\Temp\winupdate_240693562.exe
        
        "C:\Windows\Temp\winupdate_240693562.exe"
        308⤵
        
        PID:4632
        
        C:\Windows\Temp\winupdate_240693640.exe
        
        "C:\Windows\Temp\winupdate_240693640.exe"
        309⤵
        
        PID:1324
        
        C:\Windows\Temp\winupdate_240693765.exe
        
        "C:\Windows\Temp\winupdate_240693765.exe"
        310⤵
        
        PID:2452
        
        C:\Windows\Temp\winupdate_240693859.exe
        
        "C:\Windows\Temp\winupdate_240693859.exe"
        311⤵
        
        PID:848
        
        C:\Windows\Temp\winupdate_240693984.exe
        
        "C:\Windows\Temp\winupdate_240693984.exe"
        312⤵
        
        PID:2552
        
        C:\Windows\Temp\winupdate_240694078.exe
        
        "C:\Windows\Temp\winupdate_240694078.exe"
        313⤵
        
        PID:472
        
        C:\Windows\Temp\winupdate_240694234.exe
        
        "C:\Windows\Temp\winupdate_240694234.exe"
        314⤵
        
        PID:400
        
        C:\Windows\Temp\winupdate_240694328.exe
        
        "C:\Windows\Temp\winupdate_240694328.exe"
        315⤵
        
        PID:2436
        
        C:\Windows\Temp\winupdate_240694453.exe
        
        "C:\Windows\Temp\winupdate_240694453.exe"
        316⤵
        
        PID:4220
        
        C:\Windows\Temp\winupdate_240694609.exe
        
        "C:\Windows\Temp\winupdate_240694609.exe"
        317⤵
        
        PID:2260
        
        C:\Windows\Temp\winupdate_240694750.exe
        
        "C:\Windows\Temp\winupdate_240694750.exe"
        318⤵
        
        PID:3828
        
        C:\Windows\Temp\winupdate_240694859.exe
        
        "C:\Windows\Temp\winupdate_240694859.exe"
        319⤵
        
        PID:4248
        
        C:\Windows\Temp\winupdate_240694984.exe
        
        "C:\Windows\Temp\winupdate_240694984.exe"
        320⤵
        
        PID:2836
        
        C:\Windows\Temp\winupdate_240695140.exe
        
        "C:\Windows\Temp\winupdate_240695140.exe"
        321⤵
        
        PID:5156
        
        C:\Windows\Temp\winupdate_240695234.exe
        
        "C:\Windows\Temp\winupdate_240695234.exe"
        322⤵
        
        PID:5200
        
        C:\Windows\Temp\winupdate_240695328.exe
        
        "C:\Windows\Temp\winupdate_240695328.exe"
        323⤵
        
        PID:5244
        
        C:\Windows\Temp\winupdate_240695453.exe
        
        "C:\Windows\Temp\winupdate_240695453.exe"
        324⤵
        
        PID:5288
        
        C:\Windows\Temp\winupdate_240695593.exe
        
        "C:\Windows\Temp\winupdate_240695593.exe"
        325⤵
        
        PID:5332
        
        C:\Windows\Temp\winupdate_240695687.exe
        
        "C:\Windows\Temp\winupdate_240695687.exe"
        326⤵
        
        PID:5376
        
        C:\Windows\Temp\winupdate_240695968.exe
        
        "C:\Windows\Temp\winupdate_240695968.exe"
        327⤵
        
        PID:5420
        
        C:\Windows\Temp\winupdate_240696140.exe
        
        "C:\Windows\Temp\winupdate_240696140.exe"
        328⤵
        
        PID:5464
        
        C:\Windows\Temp\winupdate_240696296.exe
        
        "C:\Windows\Temp\winupdate_240696296.exe"
        329⤵
        
        PID:5508
        
        C:\Windows\Temp\winupdate_240696437.exe
        
        "C:\Windows\Temp\winupdate_240696437.exe"
        330⤵
        
        PID:5552
        
        C:\Windows\Temp\winupdate_240696562.exe
        
        "C:\Windows\Temp\winupdate_240696562.exe"
        331⤵
        
        PID:5596
        
        C:\Windows\Temp\winupdate_240696734.exe
        
        "C:\Windows\Temp\winupdate_240696734.exe"
        332⤵
        
        PID:5640
        
        C:\Windows\Temp\winupdate_240696906.exe
        
        "C:\Windows\Temp\winupdate_240696906.exe"
        333⤵
        
        PID:5684
        
        C:\Windows\Temp\winupdate_240697046.exe
        
        "C:\Windows\Temp\winupdate_240697046.exe"
        334⤵
        
        PID:5728
        
        C:\Windows\Temp\winupdate_240697171.exe
        
        "C:\Windows\Temp\winupdate_240697171.exe"
        335⤵
        
        PID:5772
        
        C:\Windows\Temp\winupdate_240697234.exe
        
        "C:\Windows\Temp\winupdate_240697234.exe"
        336⤵
        
        PID:5816
        
        C:\Windows\Temp\winupdate_240697343.exe
        
        "C:\Windows\Temp\winupdate_240697343.exe"
        337⤵
        
        PID:5860
        
        C:\Windows\Temp\winupdate_240697531.exe
        
        "C:\Windows\Temp\winupdate_240697531.exe"
        338⤵
        
        PID:5904
        
        C:\Windows\Temp\winupdate_240697625.exe
        
        "C:\Windows\Temp\winupdate_240697625.exe"
        339⤵
        
        PID:5948
        
        C:\Windows\Temp\winupdate_240697734.exe
        
        "C:\Windows\Temp\winupdate_240697734.exe"
        340⤵
        
        PID:5992
        
        C:\Windows\Temp\winupdate_240697906.exe
        
        "C:\Windows\Temp\winupdate_240697906.exe"
        341⤵
        
        PID:6036
        
        C:\Windows\Temp\winupdate_240698015.exe
        
        "C:\Windows\Temp\winupdate_240698015.exe"
        342⤵
        
        PID:6080
        
        C:\Windows\Temp\winupdate_240698109.exe
        
        "C:\Windows\Temp\winupdate_240698109.exe"
        343⤵
        
        PID:6124
        
        C:\Windows\Temp\winupdate_240698218.exe
        
        "C:\Windows\Temp\winupdate_240698218.exe"
        344⤵
        
        PID:4488
        
        C:\Windows\Temp\winupdate_240698328.exe
        
        "C:\Windows\Temp\winupdate_240698328.exe"
        345⤵
        
        PID:5152
        
        C:\Windows\Temp\winupdate_240698406.exe
        
        "C:\Windows\Temp\winupdate_240698406.exe"
        346⤵
        
        PID:5216
        
        C:\Windows\Temp\winupdate_240698515.exe
        
        "C:\Windows\Temp\winupdate_240698515.exe"
        347⤵
        
        PID:5268
        
        C:\Windows\Temp\winupdate_240698640.exe
        
        "C:\Windows\Temp\winupdate_240698640.exe"
        348⤵
        
        PID:5312
        
        C:\Windows\Temp\winupdate_240698734.exe
        
        "C:\Windows\Temp\winupdate_240698734.exe"
        349⤵
        
        PID:5352
        
        C:\Windows\Temp\winupdate_240698890.exe
        
        "C:\Windows\Temp\winupdate_240698890.exe"
        350⤵
        
        PID:2712
        
        C:\Windows\Temp\winupdate_240699031.exe
        
        "C:\Windows\Temp\winupdate_240699031.exe"
        351⤵
        
        PID:5396
        
        C:\Windows\Temp\winupdate_240699171.exe
        
        "C:\Windows\Temp\winupdate_240699171.exe"
        352⤵
        
        PID:5480
        
        C:\Windows\Temp\winupdate_240699250.exe
        
        "C:\Windows\Temp\winupdate_240699250.exe"
        353⤵
        
        PID:5468
        
        C:\Windows\Temp\winupdate_240699375.exe
        
        "C:\Windows\Temp\winupdate_240699375.exe"
        354⤵
        
        PID:5544
        
        C:\Windows\Temp\winupdate_240699437.exe
        
        "C:\Windows\Temp\winupdate_240699437.exe"
        355⤵
        
        PID:5584
        
        C:\Windows\Temp\winupdate_240699578.exe
        
        "C:\Windows\Temp\winupdate_240699578.exe"
        356⤵
        
        PID:5636
        
        C:\Windows\Temp\winupdate_240699687.exe
        
        "C:\Windows\Temp\winupdate_240699687.exe"
        357⤵
        
        PID:5652
        
        C:\Windows\Temp\winupdate_240699765.exe
        
        "C:\Windows\Temp\winupdate_240699765.exe"
        358⤵
        
        PID:5744
        
        C:\Windows\Temp\winupdate_240699921.exe
        
        "C:\Windows\Temp\winupdate_240699921.exe"
        359⤵
        
        PID:5800
        
        C:\Windows\Temp\winupdate_240700031.exe
        
        "C:\Windows\Temp\winupdate_240700031.exe"
        360⤵
        
        PID:5840
        
        C:\Windows\Temp\winupdate_240700125.exe
        
        "C:\Windows\Temp\winupdate_240700125.exe"
        361⤵
        
        PID:5880
        
        C:\Windows\Temp\winupdate_240700234.exe
        
        "C:\Windows\Temp\winupdate_240700234.exe"
        362⤵
        
        PID:5916
        
        C:\Windows\Temp\winupdate_240700359.exe
        
        "C:\Windows\Temp\winupdate_240700359.exe"
        363⤵
        
        PID:5952
        
        C:\Windows\Temp\winupdate_240700468.exe
        
        "C:\Windows\Temp\winupdate_240700468.exe"
        364⤵
        
        PID:6024
        
        C:\Windows\Temp\winupdate_240700593.exe
        
        "C:\Windows\Temp\winupdate_240700593.exe"
        365⤵
        
        PID:6068
        
        C:\Windows\Temp\winupdate_240700703.exe
        
        "C:\Windows\Temp\winupdate_240700703.exe"
        366⤵
        
        PID:6120
        
        C:\Windows\Temp\winupdate_240700828.exe
        
        "C:\Windows\Temp\winupdate_240700828.exe"
        367⤵
        
        PID:6132
        
        C:\Windows\Temp\winupdate_240701015.exe
        
        "C:\Windows\Temp\winupdate_240701015.exe"
        368⤵
        
        PID:5172
        
        C:\Windows\Temp\winupdate_240701125.exe
        
        "C:\Windows\Temp\winupdate_240701125.exe"
        369⤵
        
        PID:5196
        
        C:\Windows\Temp\winupdate_240701234.exe
        
        "C:\Windows\Temp\winupdate_240701234.exe"
        370⤵
        
        PID:5236
        
        C:\Windows\Temp\winupdate_240701421.exe
        
        "C:\Windows\Temp\winupdate_240701421.exe"
        371⤵
        
        PID:5292
        
        C:\Windows\Temp\winupdate_240701625.exe
        
        "C:\Windows\Temp\winupdate_240701625.exe"
        372⤵
        
        PID:5300
        
        C:\Windows\Temp\winupdate_240701765.exe
        
        "C:\Windows\Temp\winupdate_240701765.exe"
        373⤵
        
        PID:820
        
        C:\Windows\Temp\winupdate_240701890.exe
        
        "C:\Windows\Temp\winupdate_240701890.exe"
        374⤵
        
        PID:5428
        
        C:\Windows\Temp\winupdate_240702015.exe
        
        "C:\Windows\Temp\winupdate_240702015.exe"
        375⤵
        
        PID:5432
        
        C:\Windows\Temp\winupdate_240702125.exe
        
        "C:\Windows\Temp\winupdate_240702125.exe"
        376⤵
        
        PID:5472
        
        C:\Windows\Temp\winupdate_240702250.exe
        
        "C:\Windows\Temp\winupdate_240702250.exe"
        377⤵
        
        PID:5568
        
        C:\Windows\Temp\winupdate_240702328.exe
        
        "C:\Windows\Temp\winupdate_240702328.exe"
        378⤵
        
        PID:5592
        
        C:\Windows\Temp\winupdate_240702453.exe
        
        "C:\Windows\Temp\winupdate_240702453.exe"
        379⤵
        
        PID:5672
        
        C:\Windows\Temp\winupdate_240702546.exe
        
        "C:\Windows\Temp\winupdate_240702546.exe"
        380⤵
        
        PID:5716
        
        C:\Windows\Temp\winupdate_240702640.exe
        
        "C:\Windows\Temp\winupdate_240702640.exe"
        381⤵
        
        PID:5784
        
        C:\Windows\Temp\winupdate_240702828.exe
        
        "C:\Windows\Temp\winupdate_240702828.exe"
        382⤵
        
        PID:5792
        
        C:\Windows\Temp\winupdate_240702968.exe
        
        "C:\Windows\Temp\winupdate_240702968.exe"
        383⤵
        
        PID:5852
        
        C:\Windows\Temp\winupdate_240703125.exe
        
        "C:\Windows\Temp\winupdate_240703125.exe"
        384⤵
        
        PID:5864

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery