530390bf9ace1635b0b75d8d0719a081a4f49c56c7dc2544a803d435b0b74e8a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\killable.exe,"	killable.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\killable.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe,"	SecurityHealthService.exe

Enumerates VirtualBox DLL files 2 TTPs 9 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	killable.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	killable.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	killable.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	killable.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	killable.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	killable.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	killable.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	killable.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5948	bcdedit.exe
4844	bcdedit.exe
1124	bcdedit.exe
4896	bcdedit.exe
668	bcdedit.exe
4880	bcdedit.exe
6040	bcdedit.exe
3764	bcdedit.exe
4844	bcdedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe
3456	powershell.exe
1516	powershell.exe
3076	powershell.exe
4368	powershell.exe
6124	powershell.exe
5932	powershell.exe
3368	powershell.exe
1412	powershell.exe
5048	powershell.exe
5740	powershell.exe
3252	powershell.exe
2564	powershell.exe
3520	powershell.exe
3196	powershell.EXE
3264	powershell.exe
2916	powershell.exe
4356	powershell.exe
5956	powershell.exe
3536	powershell.EXE
960	powershell.exe
1124	powershell.exe
2388	powershell.exe
5184	powershell.exe
4764	powershell.exe
5020	powershell.exe
3892	powershell.exe
1084	powershell.exe
1348	powershell.exe
4844	powershell.exe
2884	powershell.exe
5796	powershell.exe
5320	powershell.exe
3848	powershell.exe
4456	powershell.exe
3152	powershell.exe
6080	powershell.exe
6060	powershell.exe
3368	powershell.exe
2900	powershell.exe
4664	powershell.exe
5340	powershell.exe
4732	powershell.exe
3868	Process not Found
6024	powershell.exe
1360	powershell.exe
5124	powershell.exe
5704	powershell.exe
3068	powershell.exe
3392	powershell.exe
3388	powershell.exe
4736	powershell.exe
4424	powershell.exe
4236	powershell.exe
3772	powershell.exe
5420	powershell.exe
3528	powershell.exe
6088	powershell.exe
3456	powershell.exe
1908	powershell.EXE
1872	powershell.exe
6004	powershell.exe
5228	powershell.exe
1448	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	killable.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	killable.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe

Looks for VMWare services registry key. 1 TTPs 9 IoCs

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe

Creates a file in the Startup directory 1 TTPs 10 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\downloads\screenshot.png	SecurityHealthService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	killable.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\downloads\screenshot.png	SecurityHealthService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\downloads\screenshot.png	killable.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\downloads\screenshot.png	SecurityHealthService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\downloads\screenshot.png	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	killable.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\downloads\screenshot.png	killable.exe

Executes a file named after a Windows system binary 1 TTPs 8 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe	killable.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\RuntimeBroker.exe	killable.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\RuntimeBroker.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\RuntimeBroker.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 7 IoCs

pid	Process
2772	killable.exe
5740	vanixfivem.exe
4196	killable.exe
4936	SecurityHealthService.exe
5460	SecurityHealthService.exe
4776	SecurityHealthService.exe
5408	SecurityHealthService.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	killable.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	killable.exe

Loads dropped DLL 64 IoCs

pid	Process
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4196	killable.exe
4776	SecurityHealthService.exe
4776	SecurityHealthService.exe
5408	SecurityHealthService.exe
5408	SecurityHealthService.exe
4776	SecurityHealthService.exe
4776	SecurityHealthService.exe
5408	SecurityHealthService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	killable.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	discord.com
43	discord.com
44	discord.com
17	discord.com
19	discord.com
21	discord.com
22	discord.com
40	discord.com
9	discord.com
42	discord.com
46	discord.com
47	discord.com
8	discord.com
18	discord.com
41	discord.com
45	discord.com
48	discord.com
1	discord.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\F:	Process not Found

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Clear Persistence

T1070.009

pid	Process
4704	cmd.exe
4892	cmd.exe
4960	cmd.exe

Looks up external IP address via web service 1 TTPs 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
34	ip-api.com
1	api.ipify.org
1	ipapi.co
11	api.ipify.org
26	ip-api.com
33	api.ipify.org
35	ipapi.co
1	ip-api.com
12	ip-api.com
13	ipapi.co
25	api.ipify.org
27	ipapi.co

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	killable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5124	tasklist.exe
2468	tasklist.exe
4704	tasklist.exe
5888	tasklist.exe
1932	tasklist.exe
5580	tasklist.exe
1060	tasklist.exe
3592	tasklist.exe
2400	tasklist.exe
1052	tasklist.exe
1112	tasklist.exe
5716	tasklist.exe
5792	tasklist.exe
5344	tasklist.exe
5136	tasklist.exe
5328	tasklist.exe
4616	tasklist.exe
5256	tasklist.exe
5816	tasklist.exe
3904	tasklist.exe
1348	tasklist.exe
1352	tasklist.exe
4960	tasklist.exe
2916	tasklist.exe
4176	tasklist.exe
5464	tasklist.exe
616	tasklist.exe
1492	tasklist.exe
3308	tasklist.exe
1912	tasklist.exe
2996	tasklist.exe
5456	tasklist.exe
4068	tasklist.exe
4456	tasklist.exe
1528	tasklist.exe
6024	tasklist.exe
1572	tasklist.exe
1060	tasklist.exe
4304	tasklist.exe
3068	tasklist.exe
4904	tasklist.exe
5380	tasklist.exe
5640	tasklist.exe
5124	tasklist.exe
4852	tasklist.exe
5152	tasklist.exe
2400	tasklist.exe
1328	tasklist.exe
720	tasklist.exe
5000	tasklist.exe
2960	tasklist.exe
3156	tasklist.exe
3904	tasklist.exe
3700	tasklist.exe
1084	tasklist.exe
1776	tasklist.exe
4716	tasklist.exe
5484	tasklist.exe
4292	tasklist.exe
4164	tasklist.exe
6040	tasklist.exe
3460	tasklist.exe
3904	tasklist.exe
3276	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4960	wscript.exe
5828	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 11 IoCs

Debugger Evasion

T1622

pid	Process
4196	killable.exe
5408	SecurityHealthService.exe
4776	SecurityHealthService.exe
4196	killable.exe
5408	SecurityHealthService.exe
4776	SecurityHealthService.exe
4196	killable.exe
5408	SecurityHealthService.exe
4776	SecurityHealthService.exe
4196	killable.exe
5408	SecurityHealthService.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	killable.exe
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kg0ajmzy.acj.psm1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_q14dowip.e0h.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_24q3mvh4.zeo.psm1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vx0nkkij.233.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dxqkka3p.uqj.psm1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5wbqsizr.pdr.ps1	powershell.EXE

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
4132	Process not Found
4576	Process not Found
2376	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1276	cmd.exe
4712	cmd.exe
4796	cmd.exe
2296	cmd.exe
1304	cmd.exe
1932	cmd.exe
1308	cmd.exe
2424	cmd.exe
624	cmd.exe
4224	cmd.exe
5032	cmd.exe
2208	cmd.exe
4192	cmd.exe
3688	cmd.exe
2220	cmd.exe
616	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Process not Found

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	killable.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	killable.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	killable.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe

Kills process with taskkill 12 IoCs

pid	Process
4308	Process not Found
4344	Process not Found
1712	Process not Found
4208	Process not Found
4928	Process not Found
808	Process not Found
612	Process not Found
272	taskkill.exe
1432	Process not Found
2584	Process not Found
5380	Process not Found
4268	Process not Found

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	Process not Found

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{13680113-24F0-46B0-87E1-7BE13A63E83A}	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	Process not Found
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{A95DF8F0-52C3-4249-9438-AE1AF691E08E}	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6048	schtasks.exe
3080	schtasks.exe
3668	schtasks.exe
808	schtasks.exe
252	schtasks.exe
1568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4196	killable.exe
4196	killable.exe
1216	powershell.exe
1216	powershell.exe
1216	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
6024	powershell.exe
6024	powershell.exe
6024	powershell.exe
1224	wmic.exe
1224	wmic.exe
1224	wmic.exe
1224	wmic.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe
4556	powershell.exe
4556	powershell.exe
4556	powershell.exe
3368	wmic.exe
3368	wmic.exe
3368	wmic.exe
3368	wmic.exe
5184	powershell.exe
5184	powershell.exe
5184	powershell.exe
3388	powershell.exe
3388	powershell.exe
3388	powershell.exe
4496	wmic.exe
4496	wmic.exe
4496	wmic.exe
4496	wmic.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4300	wmic.exe
4300	wmic.exe
4300	wmic.exe
4300	wmic.exe
1360	powershell.exe
1360	powershell.exe
1360	powershell.exe
4808	wmic.exe
4808	wmic.exe
4808	wmic.exe
4808	wmic.exe
3252	wmic.exe
3252	wmic.exe
3252	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	killable.exe
Token: SeDebugPrivilege	412	tasklist.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeIncreaseQuotaPrivilege	4844	powershell.exe
Token: SeSecurityPrivilege	4844	powershell.exe
Token: SeTakeOwnershipPrivilege	4844	powershell.exe
Token: SeLoadDriverPrivilege	4844	powershell.exe
Token: SeSystemProfilePrivilege	4844	powershell.exe
Token: SeSystemtimePrivilege	4844	powershell.exe
Token: SeProfSingleProcessPrivilege	4844	powershell.exe
Token: SeIncBasePriorityPrivilege	4844	powershell.exe
Token: SeCreatePagefilePrivilege	4844	powershell.exe
Token: SeBackupPrivilege	4844	powershell.exe
Token: SeRestorePrivilege	4844	powershell.exe
Token: SeShutdownPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeSystemEnvironmentPrivilege	4844	powershell.exe
Token: SeRemoteShutdownPrivilege	4844	powershell.exe
Token: SeUndockPrivilege	4844	powershell.exe
Token: SeManageVolumePrivilege	4844	powershell.exe
Token: 33	4844	powershell.exe
Token: 34	4844	powershell.exe
Token: 35	4844	powershell.exe
Token: 36	4844	powershell.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeIncreaseQuotaPrivilege	1216	powershell.exe
Token: SeSecurityPrivilege	1216	powershell.exe
Token: SeTakeOwnershipPrivilege	1216	powershell.exe
Token: SeLoadDriverPrivilege	1216	powershell.exe
Token: SeSystemProfilePrivilege	1216	powershell.exe
Token: SeSystemtimePrivilege	1216	powershell.exe
Token: SeProfSingleProcessPrivilege	1216	powershell.exe
Token: SeIncBasePriorityPrivilege	1216	powershell.exe
Token: SeCreatePagefilePrivilege	1216	powershell.exe
Token: SeBackupPrivilege	1216	powershell.exe
Token: SeRestorePrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeSystemEnvironmentPrivilege	1216	powershell.exe
Token: SeRemoteShutdownPrivilege	1216	powershell.exe
Token: SeUndockPrivilege	1216	powershell.exe
Token: SeManageVolumePrivilege	1216	powershell.exe
Token: 33	1216	powershell.exe
Token: 34	1216	powershell.exe
Token: 35	1216	powershell.exe
Token: 36	1216	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeIncreaseQuotaPrivilege	5108	powershell.exe
Token: SeSecurityPrivilege	5108	powershell.exe
Token: SeTakeOwnershipPrivilege	5108	powershell.exe
Token: SeLoadDriverPrivilege	5108	powershell.exe
Token: SeSystemProfilePrivilege	5108	powershell.exe
Token: SeSystemtimePrivilege	5108	powershell.exe
Token: SeProfSingleProcessPrivilege	5108	powershell.exe
Token: SeIncBasePriorityPrivilege	5108	powershell.exe
Token: SeCreatePagefilePrivilege	5108	powershell.exe
Token: SeBackupPrivilege	5108	powershell.exe
Token: SeRestorePrivilege	5108	powershell.exe
Token: SeShutdownPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeSystemEnvironmentPrivilege	5108	powershell.exe
Token: SeRemoteShutdownPrivilege	5108	powershell.exe
Token: SeUndockPrivilege	5108	powershell.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2892	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found
3108	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4152	Process not Found
4204	Process not Found
3108	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2772	4136	FiveM External - Ztrex.exe	88
PID 4136 wrote to memory of 5740	4136	FiveM External - Ztrex.exe	89
PID 2772 wrote to memory of 4196	2772	killable.exe	90
PID 4196 wrote to memory of 5032	4196	killable.exe	91
PID 4196 wrote to memory of 412	4196	killable.exe	93
PID 4196 wrote to memory of 4844	4196	killable.exe	96
PID 4196 wrote to memory of 2684	4196	killable.exe	98
PID 4196 wrote to memory of 1216	4196	killable.exe	100
PID 4196 wrote to memory of 5108	4196	killable.exe	102
PID 4196 wrote to memory of 6024	4196	killable.exe	104
PID 4196 wrote to memory of 1224	4196	killable.exe	106
PID 4196 wrote to memory of 4424	4196	killable.exe	108
PID 4196 wrote to memory of 5888	4196	killable.exe	110
PID 4196 wrote to memory of 5228	4196	killable.exe	112
PID 4196 wrote to memory of 2388	4196	killable.exe	114
PID 4196 wrote to memory of 1412	4196	killable.exe	116
PID 4196 wrote to memory of 4556	4196	killable.exe	118
PID 4196 wrote to memory of 2208	4196	killable.exe	120
PID 2208 wrote to memory of 1572	2208	cmd.exe	122
PID 4196 wrote to memory of 6048	4196	killable.exe	123
PID 4196 wrote to memory of 4712	4196	killable.exe	125
PID 4712 wrote to memory of 4164	4712	cmd.exe	127
PID 4196 wrote to memory of 5948	4196	killable.exe	227
PID 4196 wrote to memory of 4844	4196	killable.exe	130
PID 4196 wrote to memory of 1124	4196	killable.exe	197
PID 4196 wrote to memory of 4356	4196	killable.exe	273
PID 4196 wrote to memory of 4768	4196	killable.exe	138
PID 4196 wrote to memory of 3368	4196	killable.exe	322
PID 4196 wrote to memory of 5184	4196	killable.exe	144
PID 4196 wrote to memory of 1808	4196	killable.exe	147
PID 4196 wrote to memory of 3388	4196	killable.exe	428
PID 5460 wrote to memory of 4776	5460	SecurityHealthService.exe	151
PID 4936 wrote to memory of 5408	4936	SecurityHealthService.exe	152
PID 5408 wrote to memory of 2220	5408	SecurityHealthService.exe	153
PID 4776 wrote to memory of 1932	4776	SecurityHealthService.exe	465
PID 4196 wrote to memory of 4796	4196	killable.exe	310
PID 4196 wrote to memory of 4960	4196	killable.exe	159
PID 4196 wrote to memory of 4496	4196	killable.exe	333
PID 4196 wrote to memory of 3276	4196	killable.exe	362
PID 4196 wrote to memory of 3196	4196	killable.exe	164
PID 4196 wrote to memory of 1192	4196	killable.exe	166
PID 4196 wrote to memory of 4736	4196	killable.exe	587
PID 4776 wrote to memory of 4492	4776	SecurityHealthService.exe	237
PID 5408 wrote to memory of 1492	5408	SecurityHealthService.exe	621
PID 4196 wrote to memory of 4300	4196	killable.exe	175
PID 4776 wrote to memory of 1360	4776	SecurityHealthService.exe	515
PID 4196 wrote to memory of 5672	4196	killable.exe	232
PID 4196 wrote to memory of 4072	4196	killable.exe	181
PID 4196 wrote to memory of 4808	4196	killable.exe	645
PID 4196 wrote to memory of 3252	4196	killable.exe	214
PID 4196 wrote to memory of 1236	4196	killable.exe	371
PID 5408 wrote to memory of 1448	5408	SecurityHealthService.exe	189
PID 4776 wrote to memory of 6040	4776	SecurityHealthService.exe	717
PID 5408 wrote to memory of 5136	5408	SecurityHealthService.exe	295
PID 4196 wrote to memory of 4552	4196	killable.exe	787
PID 4776 wrote to memory of 1124	4776	SecurityHealthService.exe	854
PID 4196 wrote to memory of 4956	4196	killable.exe	199
PID 4776 wrote to memory of 3456	4776	SecurityHealthService.exe	948
PID 5408 wrote to memory of 4584	5408	SecurityHealthService.exe	203
PID 4196 wrote to memory of 5876	4196	killable.exe	204
PID 4196 wrote to memory of 5340	4196	killable.exe	414
PID 4196 wrote to memory of 5700	4196	killable.exe	744
PID 4196 wrote to memory of 5124	4196	killable.exe	777
PID 4776 wrote to memory of 1304	4776	SecurityHealthService.exe	457

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\FiveM External - Ztrex.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM External - Ztrex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\killable.exe
  "C:\Users\Admin\AppData\Local\Temp\killable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\killable.exe
    "C:\Users\Admin\AppData\Local\Temp\killable.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Enumerates VirtualBox DLL files
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare Tools registry key
    - Looks for VMWare drivers on disk
    - Looks for VMWare services registry key.
    - Creates a file in the Startup directory
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:5032
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4844
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6024
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4424
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:1572
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:4164
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5948
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4844
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {current} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1124
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4356
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4768
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5184
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3388
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4796
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4960
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4496
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3276
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3196
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe"
      4⤵
      PID:1192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4736
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4300
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5672
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4072
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4808
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3252
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:1236
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4552
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4956
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5876
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5340
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5700
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:5124
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:468
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3892
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4892
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1624
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4492
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:3460
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4148
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3392
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4204
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1488
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3868
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5056
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3324
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4356
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1912
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3912
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2900
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5468
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:1516
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6072
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3868
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4728
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5128
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5136
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5016
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2800
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3308
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1060
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5648
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3368
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4892
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5580
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3460
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5000
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5844
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1304
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3076
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5452
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1472
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1236
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:4904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5224
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5380
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2188
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5888
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2824
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5784
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4848
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:756
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3388
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1032
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3152
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5800
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5700
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:1932
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2580
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:944
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2572
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2960
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:624
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2900
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1344
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1360
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3264
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4768
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:944
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:1052
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4512
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5704
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3744
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2176
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2936
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5620
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5440
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1060
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5016
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5584
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5648
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:1348
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5000
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2188
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6040
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5464
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3076
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4948
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4520
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3420
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4764
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3240
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:476
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4444
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5960
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2564
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4304
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5768
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3068
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6140
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5716
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3108
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4560
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:240
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4656
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4772
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4768
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5016
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5932
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:1624
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1708
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4552
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4224
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2308
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4532
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5008
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      PID:424
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2788
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:3328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1520
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3908
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3592
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6004
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5560
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1048
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1948
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:720
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4892
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:716
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:252
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:904
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2780
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1708
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:3156
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4264
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2880
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3960
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:856
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4916
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:6024
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2780
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1352
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:548
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4572
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4872
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1144
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5800
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6124
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4244
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6032
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5244
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:772
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5608
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2880
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4368
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1700
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4356
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2960
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3252
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3196
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4292
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:3904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:772
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5340
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1460
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1264
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3388
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4724
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4400
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4480
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3076
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3392
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3960
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4924
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:4616
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5932
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4556
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4240
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2156
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4784
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:720
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2088
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4140
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1400
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:476
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6032
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3364
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:4852
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4672
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2880
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6024
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3196
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:476
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3540
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3408
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2012
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:6108
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1528
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:4888
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5628
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4880
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5016
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1016
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3028
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:960
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4736
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4892
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:756
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3396
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5212
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5792
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4916
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4500
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5804
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4092
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4512
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4872
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5640
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5748
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1124
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5876
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:616
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4352
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3364
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5804
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4344
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5672
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5692
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4656
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:5716
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6136
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4924
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3528
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5124
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4092
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3220
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1520
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3068
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3712
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:720
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:3248
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5108
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3592
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /tn _db418b90a /tr "powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_pb418b90a.ps1" /sc once /st 00:00 /ru SYSTEM /f"
      4⤵
      Executes a command shell one-liner
      PID:4224
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn _db418b90a /tr "powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_pb418b90a.ps1" /sc once /st 00:00 /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /run /tn _db418b90a"
      4⤵
      Executes a command shell one-liner
      PID:616
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /run /tn _db418b90a
        5⤵
        
        PID:5792
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1128
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5256
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1176
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:716
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1108
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5608
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2780
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3240
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1948
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3268
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1524
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1804
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4584
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3700
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:5792
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3236
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6128
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5008
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5940
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3272
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5228
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2836
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5056
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1204
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3528
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5360
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:612
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5252
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:124
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4060
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5116
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:3592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /delete /tn _db418b90a /f"
      4⤵
      Indicator Removal: Clear Persistence
      PID:4960
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4304
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn _db418b90a /f
        5⤵
        
        PID:468
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2176
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4164
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3272
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5800
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5152
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1932
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6024
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4344
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4552
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5340
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3252
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:2400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      PID:5356
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4060
- C:\Users\Admin\AppData\Local\Temp\vanixfivem.exe
  "C:\Users\Admin\AppData\Local\Temp\vanixfivem.exe"
  2⤵
  - Executes dropped EXE
  PID:5740

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Modifies WinLogon for persistence
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Creates a file in the Startup directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2220
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1448
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    PID:4584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    PID:1620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    PID:2400
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:5948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2884
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1308
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5000
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:4808
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4896
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:668
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4880
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1132
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4704
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4092
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1528
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3040
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5328
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4368
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:856
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3456
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:124
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /pid 4960
    3⤵
    - Kills process with taskkill
    PID:272
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3848
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4880
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5580
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:4176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4456
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    - Executes a command shell one-liner
    PID:1304
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5828
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4800
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3540
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe"
    3⤵
    - Discovers running processes
    PID:5380
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5656
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3076
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4520
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4656
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4896
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5700
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4704
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1520
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2684
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1112
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5684
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5844
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4736
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4164
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1524
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:1492
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3636
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4772
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3700
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4940
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4716
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2836
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1912
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4916
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3340
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3484
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:1948
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:3164
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2596
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5700
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3012
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5420
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4664
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2900
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5128
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4344
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2488
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3308
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4732
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4664
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1652
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5404
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4672
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1328
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5576
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:944
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3364
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4920
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5456
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6032
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3732
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4084
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3120
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3436
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4884
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3152
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1528
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1232
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4480
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2564
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3456
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5040
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3252
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5240
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1708
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5540
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3904
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4260
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3040
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4544
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2388
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4456
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3308
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3908
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4928
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4444
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:752
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5456
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3040
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3668
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1528
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3912
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4948
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1252
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4356
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5352
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5016
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4320
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5980
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3136
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2280
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4764
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1132
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4884
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4312
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3196
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1232
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4264
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3872
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4176
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2568
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3240
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5684
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1540
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:5260
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3732
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3236
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3420
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5964
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3340
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1328
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4264
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5844
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2436
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1196
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4940
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5796
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:2388
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4800
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5628
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4732
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:424
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5464
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:948
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:752
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3000
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4916
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3392
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2768
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5580
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn _de4706fb2 /tr "powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_pe4706fb2.ps1" /sc once /st 00:00 /ru SYSTEM /f"
    3⤵
    - Executes a command shell one-liner
    PID:4192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4444
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn _de4706fb2 /tr "powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_pe4706fb2.ps1" /sc once /st 00:00 /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:808
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4736
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /run /tn _de4706fb2"
    3⤵
    - Executes a command shell one-liner
    PID:3688
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn _de4706fb2
      4⤵
      PID:5252
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5456
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:4340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1524
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5876
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1516
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3136
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1048
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1968
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4520
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4732
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5932
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5364
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5964
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5184
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1508
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn _de4706fb2 /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4892
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5292
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn _de4706fb2 /f
      4⤵
      PID:2684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_cd9951ab.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3252
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:752
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:424
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:468
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_2338c13b.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3264
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2472
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2840
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5404
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_cc6e4318.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3276
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4268
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_0bcd984f.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3012
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4520
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5600
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3892
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2564
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4768
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1776
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5588
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5704
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3108
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4964
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6080
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4524
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1108
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:4576
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4424
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4808
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4764
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:548
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1908
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1360
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4932

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Creates a file in the Startup directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1932
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:4492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1360
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:6040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    PID:1304
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3252
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5048
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5816
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    PID:5580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    PID:4260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4796
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:2900
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4496
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:6136
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6040
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3764
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4844
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3412
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3276
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:956
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4292
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6108
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:3364
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6048
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5340
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3436
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5212
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:2468
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3520
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4304
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2684
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe"
    3⤵
    PID:3668
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2800
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1460
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5580
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6004
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2768
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2220
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:808
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2400
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5016
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6108
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1524
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5784
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1460
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3396
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1708
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4908
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:772
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2468
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:696
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2572
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4320
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2996
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4516
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:4808
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4904
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5888
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:756
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1228
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3536
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3636
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5108
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4576
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4704
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5936
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5020
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:1348
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:612
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3040
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3392
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:956
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4840
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5124
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1084
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2468
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4292
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4192
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2436
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1524
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1568
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2760
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2264
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5224
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5736
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1124
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5640
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4880
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3808
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3104
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4784
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1520
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:668
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1132
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2748
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4060
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5184
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5692
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4532
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3412
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2996
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2824
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4732
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5532
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6088
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3776
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4844
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1484
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2996
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1932
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2400
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4312
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5048
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2220
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:240
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:424
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4176
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4192
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4244
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2572
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2916
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5540
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5380
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6048
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1624
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1484
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1196
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5044
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2564
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5464
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3456
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:468
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3168
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4204
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4844
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5684
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1652
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1344
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1352
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4452
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2188
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5800
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3152
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:716
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1352
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5048
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:2220
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3368
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4812
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6072
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3212
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1908
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:6140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3520
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5240
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5396
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6072
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4560
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3212
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3952
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1124
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5228
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4616
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:252
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5380
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5128
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3460
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3324
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2156
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2012
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4808
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1204
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4524
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2684
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3744
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:468
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2836
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2580
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3304
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn _d4f67ecb1 /tr "powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_p4f67ecb1.ps1" /sc once /st 00:00 /ru SYSTEM /f"
    3⤵
    - Executes a command shell one-liner
    PID:624
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn _d4f67ecb1 /tr "powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_p4f67ecb1.ps1" /sc once /st 00:00 /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:252
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /run /tn _d4f67ecb1"
    3⤵
    - Executes a command shell one-liner
    PID:1276
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn _d4f67ecb1
      4⤵
      PID:4960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3892
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1400
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4220
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4880
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4060
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6080
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3000
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5244
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3436
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5624
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2308
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn _d4f67ecb1 /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1624
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn _d4f67ecb1 /f
      4⤵
      PID:5212
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3112
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_2123f804.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4512
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4800
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1488
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2280
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4464
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_b4f2d884.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5000
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4396
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_248eef73.ps1
    3⤵
    PID:4812
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3460
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:808
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:716
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2996
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1228
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5980
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4768
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -nop -w hidden -f C:\Windows\Temp\_cp_dd9b900a.ps1
    3⤵
    PID:4804
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4496
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1112
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4176
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3700
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3080
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1652
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2800
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6048
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5456
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5716
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4920
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:476
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6088
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2748
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:468
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3168
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4624
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5964
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -ep bypass -nop -w hidden -f C:\Windows\Temp\_pe4706fb2.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -ep bypass -nop -w hidden -f C:\Windows\Temp\_p4f67ecb1.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
PID:5656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -ep bypass -nop -w hidden -f C:\Windows\Temp\_pb418b90a.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3196
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Debugger Evasion

T1622

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Persistence

T1070.009

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

File and Directory Discovery

Peripheral Device Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion