64831a005b4eccebf7893444b55dd515b4aa54f705cdebd74443340049ce00be

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys"	mbamservice.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mbamservice.exe

Executes dropped EXE 8 IoCs

pid	Process
2816	7z2201.exe
1796	7z.exe
1036	7z.exe
2260	rs.exe
2756	rs.tmp
2816	mbamservice.exe
2332	mbamservice.exe
2380	mbamtray.exe

Loads dropped DLL 64 IoCs

pid	Process
2816	7z2201.exe
1796	7z.exe
1036	7z.exe
2260	rs.exe
2756	rs.tmp
2756	rs.tmp
2756	rs.tmp
2756	rs.tmp
2756	rs.tmp
2756	rs.tmp
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe
2380	mbamtray.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 61 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	mbamservice.exe
File opened (read-only)	\??\B:	mbamservice.exe
File opened (read-only)	\??\O:	mbamservice.exe
File opened (read-only)	\??\S:	mbamservice.exe
File opened (read-only)	\??\V:	mbamservice.exe
File opened (read-only)	\??\Y:	mbamservice.exe
File opened (read-only)	\??\Z:	mbamservice.exe
File opened (read-only)	\??\E:	mbamservice.exe
File opened (read-only)	\??\K:	mbamservice.exe
File opened (read-only)	\??\T:	mbamservice.exe
File opened (read-only)	\??\W:	mbamservice.exe
File opened (read-only)	\??\G:	mbamservice.exe
File opened (read-only)	\??\L:	mbamservice.exe
File opened (read-only)	\??\M:	mbamservice.exe
File opened (read-only)	\??\Q:	mbamservice.exe
File opened (read-only)	\??\U:	mbamservice.exe
File opened (read-only)	\??\X:	mbamservice.exe
File opened (read-only)	\??\H:	mbamservice.exe
File opened (read-only)	\??\I:	mbamservice.exe
File opened (read-only)	\??\J:	mbamservice.exe
File opened (read-only)	\??\N:	mbamservice.exe
File opened (read-only)	\??\P:	mbamservice.exe
File opened (read-only)	\??\R:	mbamservice.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-UN43C.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\bg.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt-br.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tr.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-8U4DG.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-A48OC.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\bn.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\es.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fa.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ps.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Uninstall.exe	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-3CEA0.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-51MLU.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-NBV4T.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-7I8RQ.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\readme.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zFM.exe	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-H238P.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SGPE3.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\is-NLO6S.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-UFG0Q.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\mng.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-VFQU3.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ast.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\de.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-94HCQ.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-1LHIB.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\en.ttt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\is-6AK00.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-1HBDN.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf	mbamservice.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ar.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-9NHDE.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\is-P0931.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\is.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tg.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-JQP1F.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-1TRQ0.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\descript.ion	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\History.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\he.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\imageformats\is-UOHRT.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SRRA3.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\eu.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pl.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\th.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-GROOQ.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-96N2C.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-1UL5L.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf	mbamservice.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.chm	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ne.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-FMQ61.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-79DH2.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\is-UPESQ.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\hu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ko.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7-zip.dll	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	mbamservice.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	mbamservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mbamservice.exe

Delays execution with timeout.exe 18 IoCs

evasion

pid	Process
1072	timeout.exe
2080	timeout.exe
2764	timeout.exe
3008	timeout.exe
2244	timeout.exe
2976	timeout.exe
2044	timeout.exe
2888	timeout.exe
2624	timeout.exe
2740	timeout.exe
2968	timeout.exe
2692	timeout.exe
1328	timeout.exe
1164	timeout.exe
2488	timeout.exe
2004	timeout.exe
2684	timeout.exe
2628	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
2968	tasklist.exe
2608	tasklist.exe
1488	tasklist.exe
1888	tasklist.exe
1720	tasklist.exe
324	tasklist.exe
1240	tasklist.exe
2236	tasklist.exe
372	tasklist.exe
2772	tasklist.exe
2360	tasklist.exe
2780	tasklist.exe
2608	tasklist.exe
2244	tasklist.exe
2716	tasklist.exe
1924	tasklist.exe
2848	tasklist.exe
2836	tasklist.exe
3036	tasklist.exe
2932	tasklist.exe
1476	tasklist.exe
2800	tasklist.exe
1660	tasklist.exe
2968	tasklist.exe
1668	tasklist.exe
1168	tasklist.exe
2916	tasklist.exe
2488	tasklist.exe
2052	tasklist.exe
2612	tasklist.exe
540	tasklist.exe
2828	tasklist.exe
1496	tasklist.exe
1980	tasklist.exe
2488	tasklist.exe
2888	tasklist.exe
3044	tasklist.exe
1148	tasklist.exe
1696	tasklist.exe
2552	tasklist.exe
1040	tasklist.exe
936	tasklist.exe
2160	tasklist.exe
1488	tasklist.exe
3012	tasklist.exe
2192	tasklist.exe
1172	tasklist.exe
1836	tasklist.exe
1976	tasklist.exe
1944	tasklist.exe
2020	tasklist.exe
440	tasklist.exe
2056	tasklist.exe
1736	tasklist.exe
952	tasklist.exe
2072	tasklist.exe
592	tasklist.exe
440	tasklist.exe
2016	tasklist.exe
1032	tasklist.exe
2860	tasklist.exe
1060	tasklist.exe
1224	tasklist.exe
1932	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	rs.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	rs.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	rs.tmp

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101975_Classes	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103800	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103800_Classes	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101414	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mbamservice.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101133	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101554	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101975	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103598	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103691	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103535	mbamservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2F14F58B-B908-4644-830F-5ACF8542D27F}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0\HELPDIR\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90A62FAD-6FA9-4454-8CEE-7EDF67437226}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ = "ICloudControllerEvents"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}\1.0	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237E618C-D739-4C8A-9F72-5CD4EF91CBE5}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\Programmable	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F95C137-46FC-42FB-A66A-F0482F3C749C}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0\FLAGS	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\0\win64	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\MBAMShlExt\ = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.ArwController.1\CLSID	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.SPController.1	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.TelemetryController.1\CLSID\ = "{DE03E614-112D-43E0-8E15-E7236CC32108}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController.1\ = "UpdateController Class"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326}\ = "ICleanControllerV6"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0\FLAGS\ = "0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\\7"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\Version	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\ = "_IMWACControllerEventsV2"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\ = "_IScannerEvents"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81701AB9-0B9C-49FE-9C79-C3C4DCA91E7B}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90F4450A-B7B2-417C-8ABB-BBD1BDFBFC27}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7DD05E6E-FF07-4CD3-A7BA-200BEC812A5C}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C85F3EB8-B099-4598-89C3-E33BAC2CE53D}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D8258E71-3A7A-4D9D-85BB-C7999F95B7E4}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\ProgID\ = "MB.ArwController.1"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\ = "_IRTPControllerEventsV3"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\ = "_IRTPControllerEventsV4"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.LogController\CurVer\ = "MB.LogController.1"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04F8CDB5-1E26-491C-8602-D2ADE2D8E17A}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\ = "IUpdateControllerV8"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B05F69B-4F9B-4FD3-A491-16153F999E00}\ = "ISPControllerV2"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115D004C-CC20-4945-BCC8-FE5043DD42D0}\TypeLib	mbamservice.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2380	mbamtray.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs

pid	Process
2816	7z2201.exe
1796	7z.exe
1036	7z.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1040	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe
2332	mbamservice.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1796	7z.exe
Token: 35	1796	7z.exe
Token: SeSecurityPrivilege	1796	7z.exe
Token: SeSecurityPrivilege	1796	7z.exe
Token: SeRestorePrivilege	1036	7z.exe
Token: 35	1036	7z.exe
Token: SeSecurityPrivilege	1036	7z.exe
Token: SeSecurityPrivilege	1036	7z.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: 33	2816	mbamservice.exe
Token: SeIncBasePriorityPrivilege	2816	mbamservice.exe
Token: 33	2332	mbamservice.exe
Token: SeIncBasePriorityPrivilege	2332	mbamservice.exe
Token: SeDebugPrivilege	2072	tasklist.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeDebugPrivilege	2500	tasklist.exe
Token: SeDebugPrivilege	2252	tasklist.exe
Token: SeDebugPrivilege	2952	tasklist.exe
Token: SeDebugPrivilege	2988	tasklist.exe
Token: SeDebugPrivilege	1676	tasklist.exe
Token: SeDebugPrivilege	2408	tasklist.exe
Token: SeDebugPrivilege	1596	tasklist.exe
Token: SeDebugPrivilege	584	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	776	tasklist.exe
Token: SeDebugPrivilege	1504	tasklist.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	2340	tasklist.exe
Token: SeDebugPrivilege	1776	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe
Token: SeDebugPrivilege	1980	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	1796	tasklist.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeRestorePrivilege	2332	mbamservice.exe
Token: SeTakeOwnershipPrivilege	2332	mbamservice.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	1660	tasklist.exe
Token: SeDebugPrivilege	2620	tasklist.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	2456	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	2552	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	1924	tasklist.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	2980	tasklist.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	1032	tasklist.exe
Token: SeDebugPrivilege	372	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	676	tasklist.exe
Token: SeDebugPrivilege	780	tasklist.exe
Token: SeDebugPrivilege	816	tasklist.exe
Token: SeDebugPrivilege	1392	tasklist.exe
Token: SeDebugPrivilege	876	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	rs.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2380	mbamtray.exe
2380	mbamtray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2228	1404	Patch MB 4.6.x.xxx.exe	28
PID 1404 wrote to memory of 2228	1404	Patch MB 4.6.x.xxx.exe	28
PID 1404 wrote to memory of 2228	1404	Patch MB 4.6.x.xxx.exe	28
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 2816	2228	cmd.exe	30
PID 2228 wrote to memory of 1916	2228	cmd.exe	31
PID 2228 wrote to memory of 1916	2228	cmd.exe	31
PID 2228 wrote to memory of 1916	2228	cmd.exe	31
PID 2228 wrote to memory of 2372	2228	cmd.exe	33
PID 2228 wrote to memory of 2372	2228	cmd.exe	33
PID 2228 wrote to memory of 2372	2228	cmd.exe	33
PID 2372 wrote to memory of 1124	2372	cmd.exe	34
PID 2372 wrote to memory of 1124	2372	cmd.exe	34
PID 2372 wrote to memory of 1124	2372	cmd.exe	34
PID 2228 wrote to memory of 1496	2228	cmd.exe	35
PID 2228 wrote to memory of 1496	2228	cmd.exe	35
PID 2228 wrote to memory of 1496	2228	cmd.exe	35
PID 1496 wrote to memory of 1480	1496	cmd.exe	37
PID 1496 wrote to memory of 1480	1496	cmd.exe	37
PID 1496 wrote to memory of 1480	1496	cmd.exe	37
PID 2228 wrote to memory of 1900	2228	cmd.exe	38
PID 2228 wrote to memory of 1900	2228	cmd.exe	38
PID 2228 wrote to memory of 1900	2228	cmd.exe	38
PID 2228 wrote to memory of 1796	2228	cmd.exe	40
PID 2228 wrote to memory of 1796	2228	cmd.exe	40
PID 2228 wrote to memory of 1796	2228	cmd.exe	40
PID 2228 wrote to memory of 1796	2228	cmd.exe	40
PID 1900 wrote to memory of 1828	1900	cmd.exe	41
PID 1900 wrote to memory of 1828	1900	cmd.exe	41
PID 1900 wrote to memory of 1828	1900	cmd.exe	41
PID 1900 wrote to memory of 1376	1900	cmd.exe	42
PID 1900 wrote to memory of 1376	1900	cmd.exe	42
PID 1900 wrote to memory of 1376	1900	cmd.exe	42
PID 1900 wrote to memory of 1068	1900	cmd.exe	43
PID 1900 wrote to memory of 1068	1900	cmd.exe	43
PID 1900 wrote to memory of 1068	1900	cmd.exe	43
PID 1900 wrote to memory of 1372	1900	cmd.exe	44
PID 1900 wrote to memory of 1372	1900	cmd.exe	44
PID 1900 wrote to memory of 1372	1900	cmd.exe	44
PID 1900 wrote to memory of 1632	1900	cmd.exe	45
PID 1900 wrote to memory of 1632	1900	cmd.exe	45
PID 1900 wrote to memory of 1632	1900	cmd.exe	45
PID 1632 wrote to memory of 1168	1632	cmd.exe	46
PID 1632 wrote to memory of 1168	1632	cmd.exe	46
PID 1632 wrote to memory of 1168	1632	cmd.exe	46
PID 1632 wrote to memory of 1920	1632	cmd.exe	47
PID 1632 wrote to memory of 1920	1632	cmd.exe	47
PID 1632 wrote to memory of 1920	1632	cmd.exe	47
PID 1900 wrote to memory of 1072	1900	cmd.exe	48
PID 1900 wrote to memory of 1072	1900	cmd.exe	48
PID 1900 wrote to memory of 1072	1900	cmd.exe	48
PID 2228 wrote to memory of 1036	2228	cmd.exe	49
PID 2228 wrote to memory of 1036	2228	cmd.exe	49
PID 2228 wrote to memory of 1036	2228	cmd.exe	49
PID 2228 wrote to memory of 1036	2228	cmd.exe	49
PID 2228 wrote to memory of 1040	2228	cmd.exe	50
PID 2228 wrote to memory of 1040	2228	cmd.exe	50
PID 2228 wrote to memory of 1040	2228	cmd.exe	50
PID 1900 wrote to memory of 3008	1900	cmd.exe	51

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1916	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe
"C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CA91CWUI.bat" "C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe""
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2816
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\system32\findstr.exe
      findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\findstr.exe
      findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\system32\mode.com
      mode con:cols=86 lines=36
      4⤵
      PID:1828
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1376
  - - C:\Windows\system32\mode.com
      mode 70,4
      4⤵
      PID:1068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul
      4⤵
      PID:1372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $H|cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"
        5⤵
        
        PID:1168
    - - C:\Windows\system32\cmd.exe
        
        cmd
        5⤵
        
        PID:1920
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1072
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3008
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2888
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1164
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2080
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2624
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2764
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2740
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2488
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2244
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2004
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2684
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2628
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2976
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2692
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1328
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2592
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2860
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1648
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2824
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2416
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2144
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2760
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2564
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1656
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:268
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1972
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1664
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2352
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1660
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2496
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1656
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:280
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2824
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2156
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1252
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2152
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2352
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1660
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2544
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1144
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1032
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:776
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2156
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2612
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2800
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2560
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1092
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2408
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1476
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1480
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1796
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2300
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2560
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1944
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2952
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:872
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1980
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2360
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:760
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:584
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2476
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2156
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1944
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1480
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2200
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2144
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2308
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:276
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2500
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2432
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:780
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1896
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1980
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1776
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:928
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:324
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\ck.7z" -o"C:\ProgramData" -pnghfvjdfnhmgfdfGDFGdfkjxhfsdg6ujdshjflksd -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pFHFiuhyt6gfhjdgdgfduh675rgkhidfgHFDSSyg6f5s7dg -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\rs.exe
      "C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\is-VRVGI.tmp\rs.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VRVGI.tmp\rs.tmp" /SL5="$70160,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        
        PID:2756
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-12HP9.tmp\BaltimoreCyberTrustRoot.crt"
        6⤵
        
        PID:876
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-12HP9.tmp\DigiCertEVRoot.crt"
        6⤵
        
        PID:2020
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816

C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2380

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2400

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery