hxxps://mega[.]nz/file/MD9XXAqT#ncgX3ev4DUY1lsHffWaeJQT-4-kN4aZg9XQaXFdDfWw

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/MD9XXAqT#ncgX3ev4DUY1lsHffWaeJQT-4-kN4aZg9XQaXFdDfWw

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	MW3 AIO-cracked.exe

Executes dropped EXE 2 IoCs

pid	Process
4596	MW3 AIO-cracked.exe
4164	sDQ0X.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\sDQ0X.exe	MW3 AIO-cracked.exe
File created	C:\Windows\SoftwareDistribution\Download\hOogK.sys	MW3 AIO-cracked.exe

Launches sc.exe 13 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5432	sc.exe
4156	sc.exe
5184	sc.exe
1324	sc.exe
6016	sc.exe
6024	sc.exe
5920	sc.exe
5492	sc.exe
5020	sc.exe
5336	sc.exe
5900	sc.exe
5924	sc.exe
4776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 52 IoCs

evasion

pid	Process
5860	taskkill.exe
5228	taskkill.exe
5500	taskkill.exe
5624	taskkill.exe
5864	taskkill.exe
5772	taskkill.exe
5884	taskkill.exe
5448	taskkill.exe
5160	taskkill.exe
5868	taskkill.exe
5228	taskkill.exe
4928	taskkill.exe
5476	taskkill.exe
5216	taskkill.exe
4188	taskkill.exe
5828	taskkill.exe
6128	taskkill.exe
5516	taskkill.exe
5428	taskkill.exe
5840	taskkill.exe
5952	taskkill.exe
512	taskkill.exe
5816	taskkill.exe
5188	taskkill.exe
5156	taskkill.exe
5892	taskkill.exe
5720	taskkill.exe
5628	taskkill.exe
5836	taskkill.exe
5348	taskkill.exe
4552	taskkill.exe
5544	taskkill.exe
5740	taskkill.exe
2852	taskkill.exe
5728	taskkill.exe
5872	taskkill.exe
2392	taskkill.exe
5764	taskkill.exe
5512	taskkill.exe
5144	taskkill.exe
5752	taskkill.exe
5184	taskkill.exe
5156	taskkill.exe
5932	taskkill.exe
5136	taskkill.exe
3592	taskkill.exe
5484	taskkill.exe
6032	taskkill.exe
6012	taskkill.exe
5788	taskkill.exe
5336	taskkill.exe
5760	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MW3 AIO-cracked.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe
4596	MW3 AIO-cracked.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: 33	1188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1188	AUDIODG.EXE
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	512	taskkill.exe
Token: SeDebugPrivilege	5156	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	5500	taskkill.exe
Token: SeDebugPrivilege	5512	taskkill.exe
Token: SeDebugPrivilege	5728	taskkill.exe
Token: SeDebugPrivilege	5816	taskkill.exe
Token: SeDebugPrivilege	5836	taskkill.exe
Token: SeDebugPrivilege	5828	taskkill.exe
Token: SeDebugPrivilege	5872	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	5884	taskkill.exe
Token: SeDebugPrivilege	5188	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	5216	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	5160	taskkill.exe
Token: SeDebugPrivilege	5228	taskkill.exe
Token: SeDebugPrivilege	3592	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	5428	taskkill.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	5764	taskkill.exe
Token: SeDebugPrivilege	5544	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	6032	taskkill.exe
Token: SeDebugPrivilege	6012	taskkill.exe
Token: SeDebugPrivilege	5752	taskkill.exe
Token: SeDebugPrivilege	5952	taskkill.exe
Token: SeDebugPrivilege	5788	taskkill.exe
Token: SeDebugPrivilege	5720	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	5184	taskkill.exe
Token: SeDebugPrivilege	5156	taskkill.exe
Token: SeDebugPrivilege	5228	taskkill.exe
Token: SeDebugPrivilege	6128	taskkill.exe
Token: SeDebugPrivilege	5348	taskkill.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeDebugPrivilege	5760	taskkill.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	5932	taskkill.exe
Token: SeDebugPrivilege	5740	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeDebugPrivilege	5448	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeSystemEnvironmentPrivilege	4164	sDQ0X.exe
Token: SeDebugPrivilege	4164	sDQ0X.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
4596	MW3 AIO-cracked.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 1648 wrote to memory of 3504	1648	firefox.exe	85
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 3824	3504	firefox.exe	86
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87
PID 3504 wrote to memory of 4524	3504	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mega.nz/file/MD9XXAqT#ncgX3ev4DUY1lsHffWaeJQT-4-kN4aZg9XQaXFdDfWw"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mega.nz/file/MD9XXAqT#ncgX3ev4DUY1lsHffWaeJQT-4-kN4aZg9XQaXFdDfWw
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.0.818811087\1054238268" -parentBuildID 20230214051806 -prefsHandle 1748 -prefMapHandle 1740 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efb21455-ecd0-43cb-bfb8-096d73b7ebba} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 1840 2566f50d458 gpu
    3⤵
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.1.1248914580\1449658243" -parentBuildID 20230214051806 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bd92393-cdae-4350-aca9-e1d66b0b7077} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 2476 25662888258 socket
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.2.1684765469\941765812" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2912 -prefsLen 23030 -prefMapSize 235121 -jsInitHandle 1192 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3fa0f4c-9953-4698-8990-836abbd5028c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3008 2567245c258 tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.3.977027033\656641468" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1192 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71f66a5b-55c0-422d-8909-8126be5869d9} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3668 25662878258 tab
    3⤵
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.4.1987765999\2057016546" -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 5280 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1192 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a92d376-0b8e-4800-9e74-66bb17390b90} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5296 256760cb858 tab
    3⤵
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.5.359922854\1672877164" -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5476 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1192 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c4258f3-438f-4408-8191-b136804b5e85} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5488 256761f0658 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.6.1243322749\889363950" -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5668 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1192 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2985410-2a82-4c94-8489-0f3653f9d0d6} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5588 256761ee258 tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.7.289049681\858612828" -childID 6 -isForBrowser -prefsHandle 1312 -prefMapHandle 5276 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1192 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {611055e6-6578-4f71-bc01-6b54310b00f5} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5920 2567700d758 tab
    3⤵
    PID:3964
- - C:\Users\Admin\Downloads\MW3 AIO-cracked.exe
    "C:\Users\Admin\Downloads\MW3 AIO-cracked.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4596
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:2800
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5136
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:4068
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:3592
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:512
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:4776
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5184
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:4220
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:2676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\MW3 AIO-cracked.exe" MD5
      4⤵
      PID:1312
    - - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "C:\Users\Admin\Downloads\MW3 AIO-cracked.exe" MD5
        5⤵
        
        PID:5172
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5332
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5500
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5344
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5512
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5356
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5484
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5364
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5492
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5372
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5476
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5380
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5600
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5836
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5608
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5728
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5816
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5624
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5900
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5632
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5872
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5640
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5648
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5656
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5664
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5892
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5676
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5924
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5684
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5860
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5692
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6056
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5160
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6064
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6072
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5228
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:6080
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5432
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:6092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:6100
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6108
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5216
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6116
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5144
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6124
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:6136
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5020
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:2460
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5188
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:220
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5396
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5336
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5580
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5544
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5528
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5428
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5568
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:1324
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5484
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5764
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5460
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5780
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5720
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5640
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6012
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5844
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5788
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5732
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:4156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5772
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5868
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5928
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5924
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5840
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5900
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5952
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:4364
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6032
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5744
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:6016
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5716
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:4876
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:1312
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5348
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5188
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5932
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5128
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5740
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5384
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:4776
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:2228
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5864
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5020
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6084
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5760
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:6080
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5628
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:436
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5212
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5336
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5496
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5260
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5492
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5184
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:2460
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6128
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5244
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5228
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5368
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:6024
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5216
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5624
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:6140
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5860
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5772
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5444
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5448
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
      4⤵
      PID:5488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
      4⤵
      PID:5852
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:5920
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
      4⤵
      PID:5528
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM HTTPDebuggerSvc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
      4⤵
      PID:5504
  - - C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
      "C:\Windows\SoftwareDistribution\Download\sDQ0X.exe" -map C:\Windows\SoftwareDistribution\Download\hOogK.sys
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4164

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x4c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jhlyxaos.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
ef6f6c424394e088b54aa69b583c2e7a

SHA1
dbdc4e080e5c4ef952fbb7fd4f745f3fc97271ea

SHA256
b541ce0e85e633c6dff776b0bc6796d6759baa2e3b1b0a953fa6f54f706483a4

SHA512
3c827a329846327a72f69114da624c4b9e878c3089d102b752a3a28cd626a2bdea7cf6f39194fa8ebaf2f7f908ae55d39c13dfd4cb790285408675c66ab478bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jhlyxaos.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
938a93d9b590d10b08edc04c45f2787b

SHA1
92f33a7ee085391e0f9f27c4bf02ac14381d90aa

SHA256
1ea1890bca1b4fe52df60e2803a81f8ec8031b82be776dc5fc48c5f13a0ac494

SHA512
43e476d7df03864b72bef32b3df560b0b874c6fb6613eaa26d4feec06e8942f3a3b52de704aa60222e09cd49120357ae427dd302f487b03513941c3d2a79ee7f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jhlyxaos.default-release\cache2\doomed\4683

Filesize
9KB

MD5
5c6bd3864c8d90757b4bbe8a05b52c43

SHA1
b9f693ca5e3ca9a678d380407d32f5eea3a74295

SHA256
14fc351e35383d24f8f83ddec9b2ba09f64708292b7bbf38921a8dfea75b0564

SHA512
fe9d7d4c3f66590c37d5827db2bb2fecf3f2f596d3efd18899e3d5827e554946142db129eff2b24de779c2d9ce74cf5dfb11e7c9c86b8647ea821ff00428cb61

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jhlyxaos.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263

Filesize
13KB

MD5
273b3221f71a98be0466a856a53acaf3

SHA1
dc95d3904e6fe9569a92cb3a98eea7a8c15b4682

SHA256
4b9e6db871982efde73dfb1866c6aa408cc7f978f6a78c818a46ee16e00299ae

SHA512
62d2d07a2fd9f4e38d8baa3abbc2cab16b98fee817d2957f0f6f9fcf6026ce7e04c876ec1b58922ed32378c7d27f160c63dec0b76d72e71fe5f33a2c30f453b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs-1.js

Filesize
7KB

MD5
2e44ed41ca36b6d75e831144310c30b9

SHA1
8a354edf4c48d067075f5efab9b2e9a0062b6fc6

SHA256
a9cd4d3803b3ea121c2ce9b71ea5f72662fa4f5e71bf6c5e6374109482029426

SHA512
b6547a0fc63711b6686360cc66118dcf0ca30671268ad2eaad81fd9a59a8979659802f13af7c713eb61a99bec93cb645402f2a47287fc9b14c5add1414c3b244

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs.js

Filesize
7KB

MD5
5c76fb602f4e882a34768f0890b47e81

SHA1
d4bb9bd9fa7db53cb658de567f2cb0946714c295

SHA256
03042c8b5e9e70716f397db82f605e74a4f8e752fec3fd6b902f8e99d14cb5f9

SHA512
1c87550e0c8d65b2ec0be6fff9ea0e29a4895ef44322f0a6d2d5061f22d39b91683ba28192008b4fca60275584017bc31c5c66d0902351d99982a6fdd81b5d0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs.js

Filesize
8KB

MD5
cba2ff40df44eb174d4307636380aad5

SHA1
f7c5438fcf9050ad7f36b3d955c72e8efc47f8d6

SHA256
a99c3f0e0750c06b6e846a4b0d07dca55ccee8cb87797df6d0b18f80d944542e

SHA512
d7ba7ac2b02be97c6054953ebc4fe0ae28d91c049b39d93d4061fb3a4487ddf8992cb04116992ea222d2ea6e9f372ae12095b3a834c115ca0beb1824ed1ab019

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\prefs.js

Filesize
6KB

MD5
7b7c701ebc046160170c277ca1fd9461

SHA1
408d13093155f7bf58d6c2a8eefef3fca032825b

SHA256
dc99c495d1684a79f7ba4275897dc0fea47426290f581e362206c79e8bc749c5

SHA512
0d3f2294ffb238aa084004eb4b896fb82e4985ad760cd8138996b4c0a88022cacdafd3590a92836350cf7ab8250c6ea7072440821cefa8db56b71394465c4434

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
0e07bf9b0773ca73fd9ab64723024939

SHA1
19800052ac92040e369ef1f38cd588a57a6527ea

SHA256
76edd457e1cff5d9c840bcc71130f3fe3a5bb2bc8a3115f25d8e82620e8d1742

SHA512
eb8590b53f0b13468ccecabffe5adbc45935ee6f2baa2285da3801030e75ee4eabfd72b5386c6bf5ad0b417da21f5c0c01b2bd04be91386fc92c8042d602ccbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\storage\default\https+++mega.nz\cache\morgue\11\{98337d86-2e7e-48ca-b525-7543a81aaa0b}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jhlyxaos.default-release\storage\default\https+++mega.nz\idb\3713173747_s_edmban.sqlite

Filesize
48KB

MD5
639ee02dc95d9b2f47b7cf28a57415cc

SHA1
2093863cdffea664cb65a1713db77ea2371e0b25

SHA256
0cb28940d2668feddc16584cd9d637189e8f81d57cce5b00a549fc01b2b8cbee

SHA512
58c3460b548a7f540d006bc8c543f7cd7ade655bde169c8b4b259fc50712721873443bd430eb81225e780b06c5e7bd01794f6e9193edfb1300dc1366f4712f60

Download Submit
C:\Users\Admin\Downloads\MW3 AIO-cracked.exe

Filesize
903KB

MD5
8092a7ed03d8cbd4db674577922e71f8

SHA1
c303fad09657972cd787590a725993ee48f464a3

SHA256
302af50f957823174059588c92790a4c6f90611e328e67783ece7ff467c337ef

SHA512
8494a136853035c6105f8dc7e092cf00d55ce70be075f043a61f9b4f569a74b94757ba4a15b653e8137af0e0ed311cf289d43889786b2fa34bf82b3a5af0d48a

Download Submit
C:\Windows\SoftwareDistribution\Download\sDQ0X.exe

Filesize
260KB

MD5
083c6c05ac5875d0b6e997e894ca07bc

SHA1
69d0116998e8a70db5852fccb86d45975ce88a9a

SHA256
03aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca

SHA512
fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf

Download Submit