5cde0fa88d9ab654714a9bd06d4440fde080314b2f36c7a7224a76fb8ed0305e

Resubmissions

29/10/2026, 18:10

261029-wsjgkaey6r9

29/10/2026, 18:00

261029-wllncadv7v9

Analysis

user interaction
yes
max time kernel
89s
max time network
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
VBS.cmd
Size 96KB
Sample261029-wllncadv7v
SHA256 5cde0fa88d9ab654714a9bd06d4440fde080314b2f36c7a7224a76fb8ed0305e
MD5 851ecaffc08a4ea60d3a4e691bb32d07
SHA1 73013bd0202c85e3b6b59d87d004b3abe3b81167
SHA512 9e3d70d592d89971ce537c39313bf5b20fe2797a29bc7cc4b82eebae78b0b91ab89c20dda269df9ab95ee2b646d653c2298a0f422767e95ad977b89115f89ac3
SSDEEP 1536:BF9Omaq2Yr+tlouo6pKOUN0kpSrdk6dQZ9ash:3Kfts
TLSH
T1F5A3B7123908185449B6B4B7AD63C20BF799C0C34162AAED78CDD06CBF7516BB2F56EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
2596	bcdedit.exe
4840	bcdedit.exe
1444	bcdedit.exe
4564	bcdedit.exe
3384	bcdedit.exe
3940	bcdedit.exe
3924	bcdedit.exe
624	bcdedit.exe
1564	bcdedit.exe
6056	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3392	powershell.exe
2348	powershell.exe
5640	powershell.exe
3456	powershell.exe
5684	powershell.exe
2388	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3144	sc.exe
1728	sc.exe
5752	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3552	cmd.exe
4752	cmd.exe
2448	cmd.exe
4068	cmd.exe
3252	cmd.exe
3148	cmd.exe
2256	cmd.exe
4908	cmd.exe
5792	cmd.exe
4688	cmd.exe
2656	cmd.exe
3836	cmd.exe
1336	cmd.exe
3300	cmd.exe
2636	cmd.exe
1052	cmd.exe
4840	cmd.exe
4844	cmd.exe
3912	cmd.exe
1104	cmd.exe
5840	cmd.exe
5576	cmd.exe
1284	cmd.exe
4468	cmd.exe
2536	cmd.exe
5884	cmd.exe
6120	cmd.exe
5940	cmd.exe
3688	cmd.exe
3504	cmd.exe
4316	cmd.exe
2544	cmd.exe
4852	cmd.exe
5108	cmd.exe
4556	cmd.exe
5984	cmd.exe
3140	cmd.exe
2324	cmd.exe
4980	cmd.exe
4360	cmd.exe
1772	cmd.exe
2748	cmd.exe
2380	cmd.exe
3456	cmd.exe
6080	cmd.exe
3216	cmd.exe
2584	cmd.exe
4160	cmd.exe
3856	cmd.exe
5296	cmd.exe
2012	cmd.exe
5364	cmd.exe
4700	cmd.exe
1836	cmd.exe
2696	cmd.exe
440	cmd.exe
4400	cmd.exe
2468	cmd.exe
1560	cmd.exe
4708	cmd.exe
5164	cmd.exe
3424	cmd.exe
4992	cmd.exe
3192	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	reg.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1068	reg.exe
1016	reg.exe
3284	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
1336	powershell.exe
1336	powershell.exe
1336	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe
6064	WMIC.exe
6064	WMIC.exe
6064	WMIC.exe
6064	WMIC.exe
4392	WMIC.exe
4392	WMIC.exe
4392	WMIC.exe
4392	WMIC.exe
4300	powershell.exe
4300	powershell.exe
5640	powershell.exe
5640	powershell.exe
4924	powershell.exe
4924	powershell.exe
3456	powershell.exe
3456	powershell.exe
5684	powershell.exe
5684	powershell.exe
5688	powershell.exe
5688	powershell.exe
2388	powershell.exe
2388	powershell.exe
4968	powershell.exe
4968	powershell.exe
816	powershell.exe
816	powershell.exe
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeSystemEnvironmentPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeIncreaseQuotaPrivilege	6064	WMIC.exe
Token: SeSecurityPrivilege	6064	WMIC.exe
Token: SeTakeOwnershipPrivilege	6064	WMIC.exe
Token: SeLoadDriverPrivilege	6064	WMIC.exe
Token: SeSystemProfilePrivilege	6064	WMIC.exe
Token: SeSystemtimePrivilege	6064	WMIC.exe
Token: SeProfSingleProcessPrivilege	6064	WMIC.exe
Token: SeIncBasePriorityPrivilege	6064	WMIC.exe
Token: SeCreatePagefilePrivilege	6064	WMIC.exe
Token: SeBackupPrivilege	6064	WMIC.exe
Token: SeRestorePrivilege	6064	WMIC.exe
Token: SeShutdownPrivilege	6064	WMIC.exe
Token: SeDebugPrivilege	6064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6064	WMIC.exe
Token: SeRemoteShutdownPrivilege	6064	WMIC.exe
Token: SeUndockPrivilege	6064	WMIC.exe
Token: SeManageVolumePrivilege	6064	WMIC.exe
Token: 33	6064	WMIC.exe
Token: 34	6064	WMIC.exe
Token: 35	6064	WMIC.exe
Token: 36	6064	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6064	WMIC.exe
Token: SeSecurityPrivilege	6064	WMIC.exe
Token: SeTakeOwnershipPrivilege	6064	WMIC.exe
Token: SeLoadDriverPrivilege	6064	WMIC.exe
Token: SeSystemProfilePrivilege	6064	WMIC.exe
Token: SeSystemtimePrivilege	6064	WMIC.exe
Token: SeProfSingleProcessPrivilege	6064	WMIC.exe
Token: SeIncBasePriorityPrivilege	6064	WMIC.exe
Token: SeCreatePagefilePrivilege	6064	WMIC.exe
Token: SeBackupPrivilege	6064	WMIC.exe
Token: SeRestorePrivilege	6064	WMIC.exe
Token: SeShutdownPrivilege	6064	WMIC.exe
Token: SeDebugPrivilege	6064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6064	WMIC.exe
Token: SeRemoteShutdownPrivilege	6064	WMIC.exe
Token: SeUndockPrivilege	6064	WMIC.exe
Token: SeManageVolumePrivilege	6064	WMIC.exe
Token: 33	6064	WMIC.exe
Token: 34	6064	WMIC.exe
Token: 35	6064	WMIC.exe
Token: 36	6064	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4392	WMIC.exe
Token: SeSecurityPrivilege	4392	WMIC.exe
Token: SeTakeOwnershipPrivilege	4392	WMIC.exe
Token: SeLoadDriverPrivilege	4392	WMIC.exe
Token: SeSystemProfilePrivilege	4392	WMIC.exe
Token: SeSystemtimePrivilege	4392	WMIC.exe
Token: SeProfSingleProcessPrivilege	4392	WMIC.exe
Token: SeIncBasePriorityPrivilege	4392	WMIC.exe
Token: SeCreatePagefilePrivilege	4392	WMIC.exe
Token: SeBackupPrivilege	4392	WMIC.exe
Token: SeRestorePrivilege	4392	WMIC.exe
Token: SeShutdownPrivilege	4392	WMIC.exe
Token: SeDebugPrivilege	4392	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4392	WMIC.exe
Token: SeRemoteShutdownPrivilege	4392	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3932	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 3144	6120	cmd.exe	90
PID 6120 wrote to memory of 4820	6120	cmd.exe	91
PID 6120 wrote to memory of 4876	6120	cmd.exe	92
PID 6120 wrote to memory of 432	6120	cmd.exe	93
PID 6120 wrote to memory of 3624	6120	cmd.exe	94
PID 6120 wrote to memory of 6112	6120	cmd.exe	95
PID 6120 wrote to memory of 908	6120	cmd.exe	96
PID 6120 wrote to memory of 1964	6120	cmd.exe	97
PID 6120 wrote to memory of 4344	6120	cmd.exe	98
PID 6120 wrote to memory of 4992	6120	cmd.exe	99
PID 4992 wrote to memory of 4528	4992	cmd.exe	100
PID 4992 wrote to memory of 4640	4992	cmd.exe	101
PID 6120 wrote to memory of 1836	6120	cmd.exe	102
PID 6120 wrote to memory of 5940	6120	cmd.exe	103
PID 5940 wrote to memory of 3392	5940	cmd.exe	104
PID 6120 wrote to memory of 3220	6120	cmd.exe	105
PID 6120 wrote to memory of 3532	6120	cmd.exe	106
PID 6120 wrote to memory of 4752	6120	cmd.exe	107
PID 4752 wrote to memory of 4496	4752	cmd.exe	108
PID 6120 wrote to memory of 5108	6120	cmd.exe	109
PID 6120 wrote to memory of 5828	6120	cmd.exe	110
PID 6120 wrote to memory of 4744	6120	cmd.exe	111
PID 6120 wrote to memory of 2448	6120	cmd.exe	112
PID 2448 wrote to memory of 828	2448	cmd.exe	113
PID 6120 wrote to memory of 3688	6120	cmd.exe	114
PID 3688 wrote to memory of 2596	3688	cmd.exe	115
PID 6120 wrote to memory of 3912	6120	cmd.exe	116
PID 3912 wrote to memory of 1336	3912	cmd.exe	117
PID 6120 wrote to memory of 4400	6120	cmd.exe	118
PID 4400 wrote to memory of 1424	4400	cmd.exe	119
PID 6120 wrote to memory of 1068	6120	cmd.exe	120
PID 6120 wrote to memory of 2196	6120	cmd.exe	121
PID 6120 wrote to memory of 1016	6120	cmd.exe	122
PID 6120 wrote to memory of 3192	6120	cmd.exe	123
PID 6120 wrote to memory of 3284	6120	cmd.exe	124
PID 3192 wrote to memory of 1728	3192	cmd.exe	127
PID 3192 wrote to memory of 2280	3192	cmd.exe	128
PID 3192 wrote to memory of 1332	3192	cmd.exe	129
PID 3192 wrote to memory of 1112	3192	cmd.exe	130
PID 3192 wrote to memory of 4632	3192	cmd.exe	131
PID 3192 wrote to memory of 1724	3192	cmd.exe	132
PID 3192 wrote to memory of 5212	3192	cmd.exe	133
PID 3192 wrote to memory of 2572	3192	cmd.exe	134
PID 3192 wrote to memory of 2460	3192	cmd.exe	135
PID 3192 wrote to memory of 4556	3192	cmd.exe	136
PID 4556 wrote to memory of 4724	4556	cmd.exe	137
PID 4556 wrote to memory of 1552	4556	cmd.exe	138
PID 3192 wrote to memory of 5792	3192	cmd.exe	139
PID 3192 wrote to memory of 2468	3192	cmd.exe	140
PID 2468 wrote to memory of 2348	2468	cmd.exe	141
PID 3192 wrote to memory of 3808	3192	cmd.exe	142
PID 3192 wrote to memory of 2856	3192	cmd.exe	143
PID 3192 wrote to memory of 1216	3192	cmd.exe	144
PID 1216 wrote to memory of 4692	1216	cmd.exe	145
PID 3192 wrote to memory of 5984	3192	cmd.exe	146
PID 3192 wrote to memory of 1284	3192	cmd.exe	147
PID 3192 wrote to memory of 3168	3192	cmd.exe	148
PID 3192 wrote to memory of 4068	3192	cmd.exe	149
PID 4068 wrote to memory of 6080	4068	cmd.exe	150
PID 3192 wrote to memory of 3248	3192	cmd.exe	151
PID 3248 wrote to memory of 4840	3248	cmd.exe	152
PID 3192 wrote to memory of 3140	3192	cmd.exe	153
PID 3140 wrote to memory of 4436	3140	cmd.exe	154
PID 3192 wrote to memory of 5740	3192	cmd.exe	155

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VBS.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query Null
  2⤵
  - Launches sc.exe
  PID:3144
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4820
- C:\Windows\System32\findstr.exe
  findstr /v "$" "VBS.cmd"
  2⤵
  PID:4876
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\VBS.cmd" "
  2⤵
  PID:432
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3624
- C:\Windows\System32\net.exe
  net use C:
  2⤵
  PID:6112
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "" "
  2⤵
  PID:908
- C:\Windows\System32\find.exe
  find /i "-el"
  2⤵
  PID:1964
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:4344
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:4528
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4640
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1836
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
  2⤵
  PID:3220
- C:\Windows\System32\find.exe
  find /i "Windows"
  2⤵
  PID:3532
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    PID:4496
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5108
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:5828
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4744
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c reg query "HKCU\Console" /v VirtualTerminalLevel 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v VirtualTerminalLevel
    3⤵
    PID:828
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c bcdedit /enum {current} /v 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\System32\bcdedit.exe
    bcdedit /enum {current} /v
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2596
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:1424
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:1068
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2196
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1016
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VBS.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" query Null
    3⤵
    - Launches sc.exe
    PID:1728
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:2280
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "VBS.cmd"
    3⤵
    PID:1332
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\VBS.cmd" "
    3⤵
    PID:1112
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4632
- - C:\Windows\System32\net.exe
    net use C:
    3⤵
    PID:1724
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:5212
- - C:\Windows\System32\find.exe
    find /i "-el"
    3⤵
    PID:2572
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:2460
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E| cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E"
      4⤵
      PID:4724
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:1552
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5792
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2348
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
    3⤵
    PID:3808
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:2856
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:4692
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5984
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:1284
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:3168
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Console" /v VirtualTerminalLevel 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v VirtualTerminalLevel
      4⤵
      PID:6080
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {current} /v 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {current} /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4840
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    PID:5740
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:3204
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    PID:5364
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:5208
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardManufacturer 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:3252
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardManufacturer
      4⤵
      Enumerates system info in registry
      PID:4576
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:6036
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardProduct 2>nul | findstr /i "Parallels"
    3⤵
    PID:2520
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardProduct
      4⤵
      Enumerates system info in registry
      PID:5144
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:1888
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:3856
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor
      4⤵
      Enumerates system info in registry
      PID:1828
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:440
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemFamily 2>nul | findstr /i "Parallels"
    3⤵
    PID:2564
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemFamily
      4⤵
      Enumerates system info in registry
      PID:2452
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:2836
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:3300
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer
      4⤵
      Enumerates system info in registry
      PID:5068
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:6056
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:1560
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName
      4⤵
      Enumerates system info in registry
      PID:1972
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:5152
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemSKU 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:4908
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemSKU
      4⤵
      Enumerates system info in registry
      PID:1596
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:5664
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try{Confirm-SecureBootUEFI}catch [System.PlatformNotSupportedException]{$false}catch{if($_.Exception.Message.Contains('0xC0000100')){$false}}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try{Confirm-SecureBootUEFI}catch [System.PlatformNotSupportedException]{$false}catch{if($_.Exception.Message.Contains('0xC0000100')){$false}}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=32;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- - C:\Windows\System32\choice.exe
    choice /C:1234 /N /M "[1] Continue [2] Exit [3] Revert Changes [4] Troubleshoot:
    3⤵
    PID:5540
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    - Executes a command shell one-liner
    PID:4708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:4488
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem"
    3⤵
    - Executes a command shell one-liner
    PID:2636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:3512
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4300
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_Processor).VirtualizationFirmwareEnabled"
    3⤵
    - Executes a command shell one-liner
    PID:4688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_Processor).VirtualizationFirmwareEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5640
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$t=Add-Type -PassThru -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern uint NtQuerySystemInformation(int c,IntPtr b,uint s,out uint r);' -Name CI2 -Namespace w2; $p=[Runtime.InteropServices.Marshal]::AllocHGlobal(8); [Runtime.InteropServices.Marshal]::WriteInt32($p,8); $r=[uint32]0; $t::NtQuerySystemInformation(103,$p,8,[ref]$r)|Out-Null; $o=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p,4); if(-not($o -band 1)){0}elseif($o -band 2){1}else{2}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$t=Add-Type -PassThru -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern uint NtQuerySystemInformation(int c,IntPtr b,uint s,out uint r);' -Name CI2 -Namespace w2; $p=[Runtime.InteropServices.Marshal]::AllocHGlobal(8); [Runtime.InteropServices.Marshal]::WriteInt32($p,8); $r=[uint32]0; $t::NtQuerySystemInformation(103,$p,8,[ref]$r)|Out-Null; $o=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p,4); if(-not($o -band 1)){0}elseif($o -band 2){1}else{2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4924
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pxjiks3o\pxjiks3o.cmdline"
        5⤵
        
        PID:1728
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10C5.tmp" "c:\Users\Admin\AppData\Local\Temp\pxjiks3o\CSCD920029D291E4ED8A1B264FE1FA3704F.TMP"
        6⤵
        
        PID:5948
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2656
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello" /v Enabled
      4⤵
      PID:2572
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3152
- - C:\Windows\System32\findstr.exe
    findstr /i "FACEIT"
    3⤵
    PID:5764
- - C:\Windows\System32\sc.exe
    sc query MacType
    3⤵
    - Launches sc.exe
    PID:5752
- - C:\Windows\System32\findstr.exe
    findstr /i "RUNNING"
    3⤵
    PID:5472
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /s 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3504
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /s
      4⤵
      PID:268
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked 2>nul
    3⤵
    PID:4272
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked
      4⤵
      PID:240
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1052
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked
      4⤵
      PID:1192
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags 2>nul
    3⤵
    PID:4332
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags
      4⤵
      PID:2620
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Mandatory 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3836
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Mandatory
      4⤵
      PID:5708
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureBiometrics" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5576
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureBiometrics" /v Enabled
      4⤵
      PID:4692
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureBiometrics 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2544
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureBiometrics
      4⤵
      PID:816
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureBiometrics" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1284
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureBiometrics" /v Enabled
      4⤵
      PID:3168
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureFingerprint" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:6080
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureFingerprint" /v Enabled
      4⤵
      PID:5796
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureFingerprint 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4840
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureFingerprint
      4⤵
      PID:3372
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureFingerprint" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4700
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureFingerprint" /v Enabled
      4⤵
      PID:3656
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HyperGuard" /v Enabled 2>nul
    3⤵
    PID:2444
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HyperGuard" /v Enabled
      4⤵
      PID:1260
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Host-Guardian" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1104
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Host-Guardian" /v Enabled
      4⤵
      PID:2980
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4360
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity
      4⤵
      PID:4436
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4468
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures
      4⤵
      PID:5896
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled 2>nul
    3⤵
    PID:6048
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled
      4⤵
      PID:5276
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3456
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4852
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
      4⤵
      PID:5068
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5684
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v DisableHypervisorEnforcedPagingTranslation 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3552
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v DisableHypervisorEnforcedPagingTranslation
      4⤵
      PID:2684
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled 2>nul
    3⤵
    PID:4604
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled
      4⤵
      PID:2800
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3216
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags
      4⤵
      PID:4308
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1772
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags
      4⤵
      PID:3428
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$d=Add-Type -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern int NtQuerySystemInformation(uint a,IntPtr b,uint c,IntPtr d);' -Name n -Namespace w -PassThru;$p=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$r=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$ret=$d::NtQuerySystemInformation(196,$p,4,$r);if($ret -eq 0){$f=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p);if(($f -band 0x01)-ne 0 -or (($f -band 0x20)-ne 0 -and ($f -band 0x10)-ne 0)){Write-Output 1}else{Write-Output 0}}else{Write-Output 0}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$d=Add-Type -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern int NtQuerySystemInformation(uint a,IntPtr b,uint c,IntPtr d);' -Name n -Namespace w -PassThru;$p=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$r=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$ret=$d::NtQuerySystemInformation(196,$p,4,$r);if($ret -eq 0){$f=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p);if(($f -band 0x01)-ne 0 -or (($f -band 0x20)-ne 0 -and ($f -band 0x10)-ne 0)){Write-Output 1}else{Write-Output 0}}else{Write-Output 0}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5688
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ngouhmwa\ngouhmwa.cmdline"
        5⤵
        
        PID:5544
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D39.tmp" "c:\Users\Admin\AppData\Local\Temp\ngouhmwa\CSCE3065D01C15B45B0B945C94B7A4C43B.TMP"
        6⤵
        
        PID:2900
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:4844
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1444
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:5328
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {hypervisorsettings} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:3148
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {hypervisorsettings}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4564
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:4252
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {bootloadersettings} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:5164
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {bootloadersettings}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3384
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:4912
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:2584
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux
      4⤵
      Drops file in Windows directory
      PID:4680
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {BAEA12CB-782A-4996-91FB-836B6C153F20}
        5⤵
        Drops file in Windows directory
        
        PID:5468
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:3296
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Containers-DisposableClientVM 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:5296
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Containers-DisposableClientVM
      4⤵
      Drops file in Windows directory
      PID:5004
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {948C703E-713A-4E70-BF66-E8051A800EC9}
        5⤵
        Drops file in Windows directory
        
        PID:1568
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:2764
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V-All 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:2324
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V-All
      4⤵
      Drops file in Windows directory
      PID:1244
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {D6BBD798-C650-4D84-A333-C1614DAC9FFC}
        5⤵
        Drops file in Windows directory
        
        PID:5964
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:1548
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:VirtualMachinePlatform 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:4316
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:VirtualMachinePlatform
      4⤵
      Drops file in Windows directory
      PID:1196
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {015C9F78-9353-4900-B8EC-7EFCBB59B698}
        5⤵
        Drops file in Windows directory
        
        PID:3136
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:3752
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:HypervisorPlatform 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:1336
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:HypervisorPlatform
      4⤵
      Drops file in Windows directory
      PID:3176
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {ED3F5EBD-93CB-46EE-922C-8F65A6DFEC9B}
        5⤵
        Drops file in Windows directory
        
        PID:5064
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:5528
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2388
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4968
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5} 2>nul | findstr /i "vsmlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:2256
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3940
  - - C:\Windows\System32\findstr.exe
      findstr /i "vsmlaunchtype"
      4⤵
      PID:2348
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5884
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState
      4⤵
      PID:4692
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object displayName -eq 'Bitdefender Antivirus').displayName"
    3⤵
    - Executes a command shell one-liner
    PID:2012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object displayName -eq 'Bitdefender Antivirus').displayName"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ((Get-Process explorer).Modules.ModuleName -like '*MacType*'){exit 3}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3120
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5} 2>nul | findstr /i "testsigning"
    3⤵
    - Executes a command shell one-liner
    PID:2380
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3924
  - - C:\Windows\System32\findstr.exe
      findstr /i "testsigning"
      4⤵
      PID:1888
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5} testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:624
- - C:\Windows\System32\reg.exe
    reg add "HKLM\SOFTWARE\ManageVBS" /v TestSigning /t REG_DWORD /d 1 /f
    3⤵
    PID:4572
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5} 2>nul | findstr /i "bootmenupolicy"
    3⤵
    - Executes a command shell one-liner
    PID:440
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {3af1d3ec-ae39-11f1-a609-9b0d4a64bcc5}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1564
  - - C:\Windows\System32\findstr.exe
      findstr /i "bootmenupolicy"
      4⤵
      PID:2452
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum all 2>nul | findstr /i "advancedoptions"
    3⤵
    - Executes a command shell one-liner
    PID:3456
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum all
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6056
  - - C:\Windows\System32\findstr.exe
      findstr /i "advancedoptions"
      4⤵
      PID:1960
- - C:\Windows\System32\choice.exe
    choice /C:12 /N /M "[1] Restart Now [2] Restart Later:
    3⤵
    PID:4484
- - C:\Windows\System32\shutdown.exe
    shutdown /r /t 0
    3⤵
    PID:928
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3284

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3994855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact