8d4cf683249b4a52d4a4291c9346adfd6ce7267a0b45a570ec4758461cd4d535

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys"	mbamservice.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mbamservice.exe

Executes dropped EXE 12 IoCs

pid	Process
2832	7z2201.exe
2420	7z.exe
1536	7z.exe
1704	rs.exe
2032	tasklist.exe
588	tasklist.exe
2388	mbamservice.exe
2360	tasklist.exe
2348	tasklist.exe
2396	tasklist.exe
2588	MBAMWsc.exe
3040	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
2832	7z2201.exe
2420	7z.exe
1536	7z.exe
1704	rs.exe
2032	tasklist.exe
2032	tasklist.exe
2032	tasklist.exe
2032	tasklist.exe
2032	tasklist.exe
2032	tasklist.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	mbamservice.exe
File opened (read-only)	\??\K:	mbamservice.exe
File opened (read-only)	\??\X:	mbamservice.exe
File opened (read-only)	\??\Y:	mbamservice.exe
File opened (read-only)	\??\L:	mbamservice.exe
File opened (read-only)	\??\S:	mbamservice.exe
File opened (read-only)	\??\U:	mbamservice.exe
File opened (read-only)	\??\W:	mbamservice.exe
File opened (read-only)	\??\A:	mbamservice.exe
File opened (read-only)	\??\B:	mbamservice.exe
File opened (read-only)	\??\E:	mbamservice.exe
File opened (read-only)	\??\I:	mbamservice.exe
File opened (read-only)	\??\Q:	mbamservice.exe
File opened (read-only)	\??\R:	mbamservice.exe
File opened (read-only)	\??\T:	mbamservice.exe
File opened (read-only)	\??\V:	mbamservice.exe
File opened (read-only)	\??\G:	mbamservice.exe
File opened (read-only)	\??\H:	mbamservice.exe
File opened (read-only)	\??\M:	mbamservice.exe
File opened (read-only)	\??\N:	mbamservice.exe
File opened (read-only)	\??\O:	mbamservice.exe
File opened (read-only)	\??\P:	mbamservice.exe
File opened (read-only)	\??\Z:	mbamservice.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5	mbamservice.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5	mbamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\is-DKRQE.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-058FQ.tmp	tasklist.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sq.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.dll	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-ENB2T.tmp	tasklist.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.chm	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\he.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-DRKCL.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf	mbamservice.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zFM.exe	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-1MUU6.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-9ISFA.tmp	tasklist.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\nn.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\vi.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-QKJE8.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-LTB34.tmp	tasklist.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-K7TJA.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-PTCOJ.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-NRA0U.tmp	tasklist.exe
File created	C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbshlext.dll	mbamservice.exe
File created	C:\Program Files (x86)\7-Zip\descript.ion	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ko.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-0GCN9.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-6FVJ1.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-0FDNJ.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\is-FFCJ5.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lt.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ne.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ga.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\is-8HFSE.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-PKA12.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-6HF9D.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-EQLNB.tmp	tasklist.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\bn.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ca.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.dll	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-AUAP2.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-4CI37.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fy.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tk.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7zG.exe	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-9DNIO.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ta.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\is-LLTN1.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fr.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ga.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ps.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-TA3JN.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\gu.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\nl.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-K0SB9.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SVPFJ.tmp	tasklist.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-T43HM.tmp	tasklist.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-TR3PI.tmp	tasklist.exe
File created	C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sdk\mbam.tmf	mbamservice.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	mbamservice.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	mbamservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mbamservice.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mbamservice.exe

Delays execution with timeout.exe 19 IoCs

evasion

pid	Process
2972	timeout.exe
1500	timeout.exe
2476	timeout.exe
1592	timeout.exe
2028	timeout.exe
1764	timeout.exe
756	timeout.exe
1624	timeout.exe
1600	timeout.exe
2836	timeout.exe
108	timeout.exe
2504	timeout.exe
1496	timeout.exe
2740	timeout.exe
2980	timeout.exe
1952	timeout.exe
2896	timeout.exe
1720	timeout.exe
2856	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
2924	tasklist.exe
2292	tasklist.exe
1072	tasklist.exe
1608	tasklist.exe
1196	tasklist.exe
588	tasklist.exe
2936	tasklist.exe
1716	tasklist.exe
2112	tasklist.exe
3060	tasklist.exe
2604	tasklist.exe
2460	tasklist.exe
2672	tasklist.exe
1132	tasklist.exe
1172	tasklist.exe
2720	tasklist.exe
2704	tasklist.exe
2228	tasklist.exe
2164	tasklist.exe
1932	tasklist.exe
2760	tasklist.exe
2496	tasklist.exe
672	tasklist.exe
2704	tasklist.exe
268	tasklist.exe
580	tasklist.exe
2080	tasklist.exe
2972	tasklist.exe
688	tasklist.exe
1156	tasklist.exe
1496	tasklist.exe
3036	tasklist.exe
1532	tasklist.exe
3040	tasklist.exe
2800	tasklist.exe
1696	tasklist.exe
1364	tasklist.exe
2004	tasklist.exe
2168	tasklist.exe
2888	tasklist.exe
2256	tasklist.exe
1168	tasklist.exe
1868	tasklist.exe
2012	tasklist.exe
2072	tasklist.exe
2952	tasklist.exe
2648	tasklist.exe
332	tasklist.exe
2860	tasklist.exe
1644	tasklist.exe
1468	tasklist.exe
1196	tasklist.exe
1656	tasklist.exe
1476	tasklist.exe
2220	tasklist.exe
2016	tasklist.exe
1156	tasklist.exe
2060	tasklist.exe
1452	tasklist.exe
2028	tasklist.exe
1888	tasklist.exe
1620	tasklist.exe
564	tasklist.exe
1884	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	tasklist.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	tasklist.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	tasklist.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011154741	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011154632	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011155631	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011154398	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	MBAMWsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011155584	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011205209_Classes	mbamservice.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011205209	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011155537	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011205193	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011154741_Classes	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011155709_Classes	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011205084	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011154523	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011155709	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-12112023011205131	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	MBAMWsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mbamservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\TypeLib	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\Version	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A82D6A8-59F8-4B47-BBD0-8F5E5DBB3C7D}\TypeLib\Version = "1.0"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\TypeLib\Version = "1.0"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.TelemetryController\CurVer	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAD5232C-6E05-4458-9709-0B4DCB22EA09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8ED8EAAB-1FA5-48D4-ACD4-32645776BA28}\TypeLib\Version = "1.0"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B5186B66-AE3D-4EC4-B9F5-67EC478625BE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A82D6A8-59F8-4B47-BBD0-8F5E5DBB3C7D}\ = "ICleanControllerEvents"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\TypeLib\Version = "1.0"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8}	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\TypeLib\Version = "1.0"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\ProxyStubClsid32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89AE2EF4-3346-47C7-9DCF-ED3264527FDE}	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\ProxyStubClsid32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFB94DF8-FC15-411C-B443-E937085E2AC1}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\\10"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79CAE9D0-99AA-4FEB-B6B1-1AC1A2D8F874}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CE94D34-A1E4-4FA8-BEDC-6A32683B85F5}\ = "_IAEControllerEvents"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\ = "_IArwControllerEvents"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{118F4330-CAF5-4A54-ABB0-DC936669ED2F}	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\TypeLib	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BAFDF38F-72A8-4791-AACC-72EB8E09E460}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08932AD2-C415-4DE8-821D-5AF7A5658483}\ = "IScanControllerEventsV3"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2D4A69C-14CA-4825-9376-5B4215AF5C5E}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\malwarebytes\shell\open\command\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\assistant.exe\" -uri \"%1\""	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.AEController.1	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\TypeLib\Version = "1.0"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DC2F8F62-D471-4AD5-B346-9F214FE941A7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612}\ProxyStubClsid32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\TypeLib\Version = "1.0"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.AEController.1\CLSID	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1691A7E8-B8D1-46D5-BB29-3A4DB2D809C6}	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DB6AD16-564C-451A-A173-0F31A62B7A4D}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7F95C137-46FC-42FB-A66A-F0482F3C749C}\ = "ICloudControllerV2"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A66A096-E54B-4F72-8654-ED7715B07B43}\TypeLib	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\ProxyStubClsid32	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\TypeLib\Version = "1.0"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{89AE2EF4-3346-47C7-9DCF-ED3264527FDE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.ScanController.1	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9F73DD6-F2A4-40F8-9109-67F6BB8D3704}\TypeLib\Version = "1.0"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\ProxyStubClsid32	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\TypeLib	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\ = "_IScannerEvents"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{834906DC-FA0F-4F61-BC62-24B0BEB3769C}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MBAMExt.MBAMShlExt	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EF16D72-5906-4045-86BC-16826F6212FE}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\Version	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.MWACController\CurVer\ = "MB.MWACController.1"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21EA9E3C-6507-4725-8F4F-ED4DDDE7A709}\ProxyStubClsid32	tasklist.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\Version	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}	tasklist.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	mbamservice.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2360	tasklist.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs

pid	Process
2832	7z2201.exe
2420	7z.exe
1536	7z.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1876	powershell.exe
2940	cmd.exe
2940	cmd.exe
2940	cmd.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2360	tasklist.exe
2360	tasklist.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
2388	mbamservice.exe
1608	tasklist.exe
1608	tasklist.exe
1608	tasklist.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeRestorePrivilege	2420	7z.exe
Token: 35	2420	7z.exe
Token: SeSecurityPrivilege	2420	7z.exe
Token: SeSecurityPrivilege	2420	7z.exe
Token: SeRestorePrivilege	1536	7z.exe
Token: 35	1536	7z.exe
Token: SeSecurityPrivilege	1536	7z.exe
Token: SeSecurityPrivilege	1536	7z.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	2940	cmd.exe
Token: 33	588	tasklist.exe
Token: SeIncBasePriorityPrivilege	588	tasklist.exe
Token: 33	2388	mbamservice.exe
Token: SeIncBasePriorityPrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeTakeOwnershipPrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeBackupPrivilege	2388	mbamservice.exe
Token: SeSecurityPrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeBackupPrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeTakeOwnershipPrivilege	2388	mbamservice.exe
Token: SeAssignPrimaryTokenPrivilege	2388	mbamservice.exe
Token: SeIncreaseQuotaPrivilege	2388	mbamservice.exe
Token: SeSecurityPrivilege	2388	mbamservice.exe
Token: SeTakeOwnershipPrivilege	2388	mbamservice.exe
Token: SeLoadDriverPrivilege	2388	mbamservice.exe
Token: SeSystemtimePrivilege	2388	mbamservice.exe
Token: SeBackupPrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeShutdownPrivilege	2388	mbamservice.exe
Token: SeSystemEnvironmentPrivilege	2388	mbamservice.exe
Token: SeUndockPrivilege	2388	mbamservice.exe
Token: SeManageVolumePrivilege	2388	mbamservice.exe
Token: SeRestorePrivilege	2388	mbamservice.exe
Token: SeBackupPrivilege	2388	mbamservice.exe
Token: SeDebugPrivilege	1608	tasklist.exe
Token: SeSecurityPrivilege	2388	mbamservice.exe
Token: SeSecurityPrivilege	2388	mbamservice.exe
Token: 33	3040	cmd.exe
Token: SeIncBasePriorityPrivilege	3040	cmd.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
2032	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe
2360	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2440	3060	Patch_MB 4.6.x.exe	28
PID 3060 wrote to memory of 2440	3060	Patch_MB 4.6.x.exe	28
PID 3060 wrote to memory of 2440	3060	Patch_MB 4.6.x.exe	28
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2832	2440	cmd.exe	30
PID 2440 wrote to memory of 2920	2440	cmd.exe	31
PID 2440 wrote to memory of 2920	2440	cmd.exe	31
PID 2440 wrote to memory of 2920	2440	cmd.exe	31
PID 2440 wrote to memory of 2320	2440	cmd.exe	32
PID 2440 wrote to memory of 2320	2440	cmd.exe	32
PID 2440 wrote to memory of 2320	2440	cmd.exe	32
PID 2320 wrote to memory of 2388	2320	cmd.exe	61
PID 2320 wrote to memory of 2388	2320	cmd.exe	61
PID 2320 wrote to memory of 2388	2320	cmd.exe	61
PID 2440 wrote to memory of 2276	2440	cmd.exe	34
PID 2440 wrote to memory of 2276	2440	cmd.exe	34
PID 2440 wrote to memory of 2276	2440	cmd.exe	34
PID 2276 wrote to memory of 2304	2276	cmd.exe	35
PID 2276 wrote to memory of 2304	2276	cmd.exe	35
PID 2276 wrote to memory of 2304	2276	cmd.exe	35
PID 2440 wrote to memory of 1192	2440	cmd.exe	37
PID 2440 wrote to memory of 1192	2440	cmd.exe	37
PID 2440 wrote to memory of 1192	2440	cmd.exe	37
PID 2440 wrote to memory of 2420	2440	cmd.exe	38
PID 2440 wrote to memory of 2420	2440	cmd.exe	38
PID 2440 wrote to memory of 2420	2440	cmd.exe	38
PID 2440 wrote to memory of 2420	2440	cmd.exe	38
PID 1192 wrote to memory of 1396	1192	cmd.exe	39
PID 1192 wrote to memory of 1396	1192	cmd.exe	39
PID 1192 wrote to memory of 1396	1192	cmd.exe	39
PID 1192 wrote to memory of 2416	1192	cmd.exe	66
PID 1192 wrote to memory of 2416	1192	cmd.exe	66
PID 1192 wrote to memory of 2416	1192	cmd.exe	66
PID 1192 wrote to memory of 1404	1192	cmd.exe	41
PID 1192 wrote to memory of 1404	1192	cmd.exe	41
PID 1192 wrote to memory of 1404	1192	cmd.exe	41
PID 1192 wrote to memory of 2488	1192	cmd.exe	46
PID 1192 wrote to memory of 2488	1192	cmd.exe	46
PID 1192 wrote to memory of 2488	1192	cmd.exe	46
PID 1192 wrote to memory of 2492	1192	cmd.exe	85
PID 1192 wrote to memory of 2492	1192	cmd.exe	85
PID 1192 wrote to memory of 2492	1192	cmd.exe	85
PID 2492 wrote to memory of 988	2492	cmd.exe	45
PID 2492 wrote to memory of 988	2492	cmd.exe	45
PID 2492 wrote to memory of 988	2492	cmd.exe	45
PID 2492 wrote to memory of 2036	2492	cmd.exe	44
PID 2492 wrote to memory of 2036	2492	cmd.exe	44
PID 2492 wrote to memory of 2036	2492	cmd.exe	44
PID 1192 wrote to memory of 2476	1192	cmd.exe	43
PID 1192 wrote to memory of 2476	1192	cmd.exe	43
PID 1192 wrote to memory of 2476	1192	cmd.exe	43
PID 2440 wrote to memory of 1536	2440	cmd.exe	47
PID 2440 wrote to memory of 1536	2440	cmd.exe	47
PID 2440 wrote to memory of 1536	2440	cmd.exe	47
PID 2440 wrote to memory of 1536	2440	cmd.exe	47
PID 2440 wrote to memory of 1876	2440	cmd.exe	48
PID 2440 wrote to memory of 1876	2440	cmd.exe	48
PID 2440 wrote to memory of 1876	2440	cmd.exe	48
PID 2440 wrote to memory of 2940	2440	tasklist.exe	754

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2920	attrib.exe
1716	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Patch_MB 4.6.x.exe
"C:\Users\Admin\AppData\Local\Temp\Patch_MB 4.6.x.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4136EMR4.bat" "C:\Users\Admin\AppData\Local\Temp\Patch_MB 4.6.x.exe""
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\qbF7647CA.7E\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbF7647CA.7E\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2832
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2072
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:688
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\system32\findstr.exe
      findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:2388
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2564
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\system32\findstr.exe
      findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\system32\mode.com
      mode con:cols=86 lines=36
      4⤵
      PID:1396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2892
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1988
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2416
  - - C:\Windows\system32\mode.com
      mode 70,4
      4⤵
      PID:1404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $H|cmd
      4⤵
      PID:2492
    - - C:\Windows\system32\cmd.exe
        
        cmd
        5⤵
        
        PID:2036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"
        5⤵
        
        PID:988
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_LocalTime Get Day,Month,Year /value
        5⤵
        
        PID:2912
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul
      4⤵
      PID:2488
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1600
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1592
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1516
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:1644
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1516
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2896
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2836
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:580
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2028
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2856
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2640
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:580
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1656
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2740
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:944
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1452
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1764
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2980
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2972
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1624
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:756
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1712
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2192
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2600
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3020
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2808
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2808
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2848
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2844
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2096
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2692
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2272
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2260
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1540
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2648
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2800
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:2228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1168
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:3040
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2356
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2884
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1904
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2912
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2056
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2204
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1064
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:844
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3008
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2256
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2980
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2972
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2512
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2284
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2768
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1092
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2568
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2380
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1592
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1316
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1496
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1784
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1048
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1156
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1928
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2272
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1572
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2924
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2112
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1468
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2820
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3000
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2672
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:2032
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Enumerates processes with tasklist
        
        PID:2936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2716
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2688
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2692
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1092
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1208
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:112
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:768
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:308
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2016
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:2256
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3008
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1048
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2080
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:872
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3028
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:436
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:688
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1476
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:2004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1000
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:884
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2008
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1172
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:928
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2372
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Enumerates processes with tasklist
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:844
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3004
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:1532
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2300
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1056
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2704
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:996
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3032
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2380
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2948
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2824
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2792
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1316
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1272
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1660
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2292
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2476
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2836
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2684
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2300
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2704
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2612
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:280
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2176
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:772
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2584
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2752
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2328
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2644
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:548
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Modifies system certificate store
      PID:1172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1944
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Executes dropped EXE
      Registers COM server for autorun
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2008
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:320
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2332
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:944
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:2460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2256
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2660
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1884
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2060
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2500
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Modifies system certificate store
      PID:320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2760
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:592
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2848
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2608
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:904
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2276
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2232
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:768
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Executes dropped EXE
        
        PID:2396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2788
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:800
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2936
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3004
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:268
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2476
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2808
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1092
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2368
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:3040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1196
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1480
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2544
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1620
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2896
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:588
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1588
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbF7647CA.7E\ck.7z" -o"C:\ProgramData" -pgfdgjhdfkjdyugi7ur7dyfhgjdhfgGDFgnhjdf7 -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbF7647CA.7E\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pdsfmhjgdfkmhgjkdfuBFngdkfhgiduy5rg -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\rs.exe
      "C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\is-KRFS9.tmp\rs.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KRFS9.tmp\rs.tmp" /SL5="$5015E,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        
        PID:2032
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-E5357.tmp\BaltimoreCyberTrustRoot.crt"
        6⤵
        
        PID:1172
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-E5357.tmp\DigiCertEVRoot.crt"
        6⤵
        
        PID:320
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service
        6⤵
        
        PID:588
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2504
- - C:\Windows\system32\xcopy.exe
    xcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json" "C:\ProgramData\tl"
    3⤵
    PID:1688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    PID:1608
  - - C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      PID:2348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2356
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Executes dropped EXE
        
        PID:2348
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1216
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:616
- - C:\Windows\system32\xcopy.exe
    xcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json" "C:\ProgramData\tl"
    3⤵
    PID:1580
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\ProgramData\tl"
    3⤵
    - Views/modifies file attributes
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
    3⤵
    PID:1760
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
      4⤵
      PID:2248
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2492
- - C:\Windows\system32\reg.exe
    reg Add "HKLM\SOFTWARE\Microsoft\Alu" /f /reg:32
    3⤵
    PID:2828
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
    3⤵
    PID:2344
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
    3⤵
    PID:1740
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:32
    3⤵
    PID:580

C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  PID:2360
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1500
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1344
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 1 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2588

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /FIRSTPHASEWND=$30192 /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
1⤵
PID:2396
- C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /unregserver
  2⤵
  PID:3040
- C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe" /uninstall
  2⤵
  PID:2924
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll"
  2⤵
  PID:1196
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1892
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1476

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
1⤵
PID:2920
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1740

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
1⤵
PID:2944

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2852
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1884

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:1932
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2872

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2000

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1700

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2212

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:584

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1928

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2076

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2304

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1168

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2992
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2028
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2660

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1580

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2396

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1452

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1468

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2672

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:756
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2684

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2780

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1696

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2696

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2932

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2796

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2628

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2592

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:812

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2124

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:3036
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1396

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2168
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2368

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3040

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2324

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:1868

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1716

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1740

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1896
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2224

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:3060
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2224

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1460
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1520

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1764
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2292

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2044

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2972

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1952
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2420

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:772

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2300

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2060
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2476

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2100
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2932
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:868

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2760
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2796

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2544
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2860
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1332

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:320
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1708

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1620

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1524

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1672

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2112

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:1452

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:280
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2100

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1732

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2688

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3064

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:592

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1872

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1728

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3040
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:936

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1868

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2364

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2472

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2812

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2608

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:628
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2168

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2784
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2276

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2668
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2876

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1480
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1216

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1868

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1716

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1360
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1764

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:984
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1468

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2700
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1504

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:996

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1732

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2952
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2712

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2368

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2492

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2020

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:584

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1092

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2776

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2680
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2448

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1244

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2424
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2700

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1640

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2264

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:548

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2544

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:636

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2472

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2292

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2720

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2964

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery