57349b250ca16b092d476510d2781181e1a9c698313af06e63c361962f7d7403

Analysis

user interaction
yes
max time kernel
300s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emulatortool.exe
Size 155.4MB
Sample260622-td5edaev2s
SHA256 57349b250ca16b092d476510d2781181e1a9c698313af06e63c361962f7d7403
MD5 e711265c3d1562ab16d6d192c824c2a1
SHA1 e77ecd88768ef3b5abd7e31b061968cfa4e0e512
SHA512 e10a6c1266ccdb0b9e82559ffd4b97b8ff6f8774a327ba00f66382025e953cc6c51789e0ea93c28045763c5e9abda4eafdf519313af32247d53f951be81fff14
SSDEEP 786432:R2g9A8Oa89TsG5YWV5OtsFGtatWbhsCrTG5mfOm5cuA0zm767EPl:M6A838JsHWEd2CvG8fOkZboPl
TLSH
T128787D1163E81A45E67B8678D77382A1E6B1BC535711C1CF0094FA4A2F73BC2BA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	emulatortool.exe

Loads dropped DLL 3 IoCs

pid	Process
2612	emulatortool.exe
2612	emulatortool.exe
2612	emulatortool.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
56	raw.githubusercontent.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 46 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3864	powershell.exe
2564	powershell.exe
2360	powershell.exe
1008	powershell.exe
1028	powershell.exe
4928	powershell.exe
1552	powershell.exe
3300	powershell.exe
1364	powershell.exe
4784	powershell.exe
2008	powershell.exe
3120	powershell.exe
3232	powershell.exe
4820	powershell.exe
896	powershell.exe
4220	powershell.exe
1264	powershell.exe
2392	powershell.exe
5064	powershell.exe
4052	powershell.exe
4376	powershell.exe
2536	powershell.exe
2776	powershell.exe
3432	powershell.exe
3548	powershell.exe
2524	powershell.exe
4928	powershell.exe
2676	powershell.exe
2388	powershell.exe
2852	powershell.exe
5036	powershell.exe
4660	powershell.exe
2120	powershell.exe
3944	powershell.exe
3436	powershell.exe
628	powershell.exe
3132	powershell.exe
3420	powershell.exe
2456	powershell.exe
3316	powershell.exe
5004	powershell.exe
2320	powershell.exe
4284	powershell.exe
3504	powershell.exe
1880	powershell.exe
4624	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2484	sc.exe
1236	sc.exe
396	sc.exe
5052	sc.exe
3632	sc.exe
3548	sc.exe
5024	sc.exe
5040	sc.exe
2008	sc.exe
680	sc.exe
3740	sc.exe
4568	sc.exe
2604	sc.exe
3840	sc.exe
1620	sc.exe
5016	sc.exe
1028	sc.exe
896	sc.exe
1336	sc.exe
1504	sc.exe
3740	sc.exe
3732	sc.exe
1044	sc.exe
60	sc.exe
4100	sc.exe
4660	sc.exe
2200	sc.exe
1552	sc.exe
4648	sc.exe
4592	sc.exe
2124	sc.exe
2240	sc.exe
4084	sc.exe
4644	sc.exe
2792	sc.exe
3520	sc.exe
4628	sc.exe
1620	sc.exe
4904	sc.exe
4908	sc.exe
3416	sc.exe
2276	sc.exe
4104	sc.exe
4052	sc.exe
2188	sc.exe
2336	sc.exe
176	sc.exe
4668	sc.exe
4528	sc.exe
716	sc.exe
2456	sc.exe
4100	sc.exe
1384	sc.exe
2564	sc.exe
3400	sc.exe
2844	sc.exe
2992	sc.exe
4452	sc.exe
2312	sc.exe
4516	sc.exe
3560	sc.exe
568	sc.exe
2592	sc.exe
3980	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2848	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266177641231431"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3316	powershell.exe
3316	powershell.exe
5004	powershell.exe
5004	powershell.exe
2676	powershell.exe
2676	powershell.exe
1264	powershell.exe
1264	powershell.exe
2388	powershell.exe
2388	powershell.exe
1008	powershell.exe
1008	powershell.exe
4640	chrome.exe
4640	chrome.exe
3548	powershell.exe
3548	powershell.exe
3548	powershell.exe
2612	emulatortool.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2392	powershell.exe
2392	powershell.exe
2392	powershell.exe
2852	powershell.exe
2852	powershell.exe
2852	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
628	powershell.exe
628	powershell.exe
628	powershell.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe
2524	powershell.exe
2524	powershell.exe
2524	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
3864	powershell.exe
3864	powershell.exe
3864	powershell.exe
2008	powershell.exe
2008	powershell.exe
2008	powershell.exe
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe
4052	powershell.exe
4052	powershell.exe
4052	powershell.exe
3120	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	emulatortool.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	3504	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
2612	emulatortool.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 3316	2612	emulatortool.exe	87
PID 2612 wrote to memory of 1236	2612	emulatortool.exe	89
PID 2612 wrote to memory of 5020	2612	emulatortool.exe	91
PID 2612 wrote to memory of 2984	2612	emulatortool.exe	93
PID 2612 wrote to memory of 2008	2612	emulatortool.exe	95
PID 2612 wrote to memory of 5004	2612	emulatortool.exe	100
PID 2612 wrote to memory of 3560	2612	emulatortool.exe	102
PID 2612 wrote to memory of 4516	2612	emulatortool.exe	104
PID 2612 wrote to memory of 1568	2612	emulatortool.exe	106
PID 2612 wrote to memory of 5036	2612	emulatortool.exe	108
PID 2612 wrote to memory of 2676	2612	emulatortool.exe	111
PID 2612 wrote to memory of 4488	2612	emulatortool.exe	113
PID 2612 wrote to memory of 680	2612	emulatortool.exe	115
PID 2612 wrote to memory of 568	2612	emulatortool.exe	117
PID 2612 wrote to memory of 896	2612	emulatortool.exe	119
PID 2612 wrote to memory of 1264	2612	emulatortool.exe	126
PID 2612 wrote to memory of 2564	2612	emulatortool.exe	128
PID 2612 wrote to memory of 4660	2612	emulatortool.exe	130
PID 2612 wrote to memory of 396	2612	emulatortool.exe	132
PID 2612 wrote to memory of 1336	2612	emulatortool.exe	134
PID 2612 wrote to memory of 2388	2612	emulatortool.exe	136
PID 2612 wrote to memory of 2540	2612	emulatortool.exe	138
PID 2612 wrote to memory of 1104	2612	emulatortool.exe	140
PID 2612 wrote to memory of 2316	2612	emulatortool.exe	142
PID 2612 wrote to memory of 4168	2612	emulatortool.exe	144
PID 2612 wrote to memory of 1008	2612	emulatortool.exe	153
PID 2612 wrote to memory of 1784	2612	emulatortool.exe	155
PID 2612 wrote to memory of 1932	2612	emulatortool.exe	157
PID 2612 wrote to memory of 5036	2612	emulatortool.exe	159
PID 2612 wrote to memory of 3740	2612	emulatortool.exe	161
PID 4640 wrote to memory of 2012	4640	chrome.exe	165
PID 4640 wrote to memory of 4684	4640	chrome.exe	166
PID 4640 wrote to memory of 4684	4640	chrome.exe	166
PID 4640 wrote to memory of 2848	4640	chrome.exe	167
PID 4640 wrote to memory of 4812	4640	chrome.exe	168
PID 4640 wrote to memory of 4812	4640	chrome.exe	168
PID 4640 wrote to memory of 2868	4640	chrome.exe	170
PID 4640 wrote to memory of 2868	4640	chrome.exe	170
PID 4640 wrote to memory of 2816	4640	chrome.exe	171
PID 4640 wrote to memory of 2816	4640	chrome.exe	171
PID 4640 wrote to memory of 4768	4640	chrome.exe	172
PID 4640 wrote to memory of 4768	4640	chrome.exe	172
PID 4640 wrote to memory of 1736	4640	chrome.exe	173
PID 4640 wrote to memory of 1736	4640	chrome.exe	173
PID 4640 wrote to memory of 1728	4640	chrome.exe	174
PID 4640 wrote to memory of 1728	4640	chrome.exe	174
PID 4640 wrote to memory of 1568	4640	chrome.exe	175
PID 4640 wrote to memory of 1568	4640	chrome.exe	175
PID 2612 wrote to memory of 3548	2612	emulatortool.exe	176
PID 2612 wrote to memory of 4588	2612	emulatortool.exe	178
PID 2612 wrote to memory of 1044	2612	emulatortool.exe	180
PID 2612 wrote to memory of 3420	2612	emulatortool.exe	182
PID 2612 wrote to memory of 3560	2612	emulatortool.exe	184
PID 2612 wrote to memory of 2320	2612	emulatortool.exe	186
PID 2612 wrote to memory of 2652	2612	emulatortool.exe	188
PID 2612 wrote to memory of 4276	2612	emulatortool.exe	190
PID 2612 wrote to memory of 2564	2612	emulatortool.exe	192
PID 2612 wrote to memory of 568	2612	emulatortool.exe	194
PID 2612 wrote to memory of 2392	2612	emulatortool.exe	196
PID 2612 wrote to memory of 2304	2612	emulatortool.exe	198
PID 2612 wrote to memory of 2536	2612	emulatortool.exe	200
PID 2612 wrote to memory of 4856	2612	emulatortool.exe	202
PID 2612 wrote to memory of 5040	2612	emulatortool.exe	204
PID 2612 wrote to memory of 2852	2612	emulatortool.exe	206

C:\Users\Admin\AppData\Local\Temp\emulatortool.exe
"C:\Users\Admin\AppData\Local\Temp\emulatortool.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:1236
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:5020
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:3560
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:1568
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:4488
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:680
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:568
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:2564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2540
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:1104
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:1932
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:5036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:4588
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:1044
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:3420
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2652
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4276
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:2536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:4856
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:3400
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4272
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:680
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1264
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:716
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:2456
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:4328
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:2240
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:1756
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:2336
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4908
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:896
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1256
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:2372
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:1504
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4100
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:4256
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:3416
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2664
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2764
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:1132
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:1788
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:4568
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4220
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3864
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:3520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:5052
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:3644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:3300
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:2792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2256
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:2200
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4336
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:3840
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2208
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:1620
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3232
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:4104
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:1444
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:5016
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:1552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3420
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2208
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:3548
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4376
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:3980
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:2200
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3300
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:3120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4648
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:420
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1932
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:1028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:4052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1020
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:60
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:3520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:2900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:3316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4660
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2552
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:1176
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:896
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:4516
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4348
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:4628
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1880
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:4804
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4988
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2776
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2452
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:3468
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:5040
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4928
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:4528
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4476
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:1856
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3432
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:712
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4284
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1008
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:2432
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:3180
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:2288
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:2188
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:4892
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2360
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:3376
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:1620
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2484
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3944
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:2124
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:3532
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:2112
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:1948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:556
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:4664
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:876
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:2008
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3436
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:5064
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4908
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:4568
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:60
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4220
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:1028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:4804
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:3740
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2456
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  PID:3820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  PID:3796
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  - Launches sc.exe
  PID:4904
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4624
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WinDefend"
  2⤵
  - Launches sc.exe
  PID:4100
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdFilter"
  2⤵
  - Launches sc.exe
  PID:2312
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisDrv"
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff90cdfc728,0x7ff90cdfc734,0x7ff90cdfc740
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,5848196911793662250,14294919331223544546,262144 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,13855342281020279322,15913528173588482321,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,14899203379236548682,3872091276127757343,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,13453858474211330582,8223649796347783954,2097152 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,76739211593506153,6962132922122986677,2097152 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,13163623573027233437,7718883867247202151,2097152 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,8908656676804090466,15955744770951259682,2097152 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,9460353325847684821,7622006956474103779,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,15100163189362906165,15237388425586107775,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,11393754925857964754,7199990653743268368,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,8448120323092260881,8548141917870889261,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,4655118057947787468,15693917979633583258,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3872,i,15896120849745390303,16776790579076123523,262144 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=868,i,13288263310022828549,10616082493163145689,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,7344040227919712665,10205811940687089060,524288 --field-trial-handle=1960,i,16459692358346925086,8824084235861496403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:2764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eff00f2c8e2a2450db586dce248bc53e728091ed07ad65cee9645a711141e79f
MD5 6f18067947f2ff2ffc63176a228c329a
SHA1 205fdf001cb3c7aaf125ad27caa4b11832aeb5f2
SHA512 dfb2d811042685876f8db75f2d392e2ff94096eefb25f9ad75d34969b857dd7a7f17f861e9fa1743d69390a46bf9631538fc85461f29737a0cd032854b8a1f2a
TLSH
T130E0E5AAC821EC2718FD4B5860144646EA50135B2B90694F3A3D5208CFB1A2A4296C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c948a942cce3c0fb231bd20cab682c4fb26701b821c56b1efd6f39a8727c9855
MD5 1d84cfd027672550591ad8eed49349c7
SHA1 ef9527dfe50e669fd6f36b2c87e377a60a76153f
SHA512 f237c83f556207def6d6ec81062a7ea01870a53dcbadd7f6105aee7f0ea43c5a03e3bb52aacdfac91ca27336721f730cfe4d907d774ce5d46d1a0d8c8f04875d
TLSH
T1115179F7C3E4867D891196E5EB256E2FCD290A14532C3C96C9D4AF0B53E2872D20024E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6e9efb22909a0316bb23dbbd961bfec02ec2fde15810d9be393c9ad505897e03
MD5 5afa181a80c57c5857ac2c8ec5359513
SHA1 68d29b9ee7102c8e9fcc321070c41082eaec64d6
SHA512 ceb1ba759786eb79cd235dbc2a654b2d9c42175e800449c10ecbadc8440b2ee85c83f4f7507389503e8e1cb4e84bdf24a6755a1e266a2e770ec7e16e8e744f36
TLSH
T1FA4178F7D3E48A7D891196E5EA216E2FCD690A14531C3C6289D4AF0B43F2872D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 675d10d2c8e8b9a32be58ca05c3c658c4d0fc1c285361d8782e1160fb76cdf9c
MD5 c8defe8d1ac7657e19fa5064ddf060ad
SHA1 84655c6dec14ee1158ecc17eb956bc72d2893df7
SHA512 13cf4803ffbd0f0acd6d7d1e8e5a3ffe5c46dbc69e769e6a965c112a2b20f26a906466acc61a6933e6f1f6c1fadf4befea9fabfbb15a38afb3ee8b2a7236e4c7
SSDEEP 192:hRGdYreTbG0v7spAPRp22F9wHsb+WNn160tjikw8zNVyIsnAUge:hRGdB2wYUX/FKw40JicXe
TLSH
T18B42B73EFA14693B5CDAD21AF9227B53D7F5102122902E94E6FC8A2C65DBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7e846dfd7535f6d8cb2e8c05178a7cf99075dd14a2facffa9178b6b14f8812b4
MD5 c5acb09d294d176d0194e4f032abf39f
SHA1 7ac6fcd596937bfc19e5901928ba28156e17d8aa
SHA512 558606cf053a906196f492e9727d961ceccdc1de3643913d21ee13412189f9e2099d957980a218f8f302a641f27c7a018340346f8d907476344e7055f6c83bd5
TLSH
T132B0120080415211C84302B01192148C71685F54970A370183E4FB33C8362A18014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597229.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597229.TMP
Size 96B
SHA256 119c31e6e9c9f91ad18dfc30bfa7574f71f6eac1c6ebc1b02accdd31bfc387d9
MD5 03e45f9bea7187f5f579603647840abc
SHA1 2daff8d21dbb23d12f976eddda90c5fa8a36e4be
SHA512 39c44bde2bc324d196ed4690409b53ea787ca46ab9f94a7bf765fcd998494cfe01bb7318b5adb665ae5e896c0142af325f41f640e879f5cd55b88ce8ce865a0d
TLSH
T1C8B02280C0022202C00303BE30C2C0C83220CF20C2030222E3E00BAACC2033080B00A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 6a1ae02144d23a1dc3551ab826bd0ad1a3e10d29404b4de2e89a52b8e8ac0a99
MD5 c5460a90f145f83b381f74d1c57ac9d5
SHA1 b5522899a4b5dd10f81ce4d078f896c38c36002c
SHA512 d65a6cbf0ccca3d1f74356fada85610f8f9f9c4d179e7072791cdce2d1a63974e6a3e5d75120ff912216caa52c43561c9bede66b7567ff7abffb839b2b62db16
SSDEEP 6144:/xEojpGqeGtHdupMZFKh5um7Rkm1tYpBeh2BAoD:JyqvHgpkFi5p9oBGcAoD
TLSH
T1333412338D7A2CF55AE5DF05354E1E0A1EF29ECBED29DDDA89824B4463C96884B09870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ea883d598fcfbcb741af31d52b15aa2c21e9468d5934215a74b11e3fc58e3dfb
MD5 8081c87944138aea8775862b81335d16
SHA1 376884fc5151f66f3ce599649bafb63ef4d72f4b
SHA512 71a3d798ba059e6c323e9d6958e698699bcd6bd76e8b57cd2adc4e4f9fca6eb810b7dce21d203443d88920408bc80f34083d39b3792c4cca68e809a5a05525e1
SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:Dm7Rkm1tYpBeh2BAoj
TLSH
T13CC3123B5D65AC3759B5BB4EB08E0A1F1EF149A7D920DE52C8D85B0833E9BCD0A05E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4275e78c8f6fd5b1e7c0bd71f794a84f6d316134dd5cd41f79a01fd2b17665b8
MD5 847b89d3bd85d322aded2bba868b7c7e
SHA1 e74aca762bba8d28ccc2bce840843fd675e6b04b
SHA512 f5571e57cfe7d7093cd92fce07caeb502239ce9b402c34029e395eb866c1d69125d024748c81acb1783ad80a04e2a7a4b5aeb577ad210ce80f22197abdfa8d37
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:bm7Rkm1tYpBeh2BAoK
TLSH
T19EC3123B5D65E8779979BB0EB08E0B1F1EF149A2D920DE92C8D86B0437E97CD0A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 531b0ac2172adf4cd179da6082fdceb699fd43b8d5884a1d6ae5cdb57d7ec48e
MD5 e263fa3449fba7bb3c76aa7fa0a036d4
SHA1 179b3dceeea5a00aecf435af4e239e1c8621afc0
SHA512 caf890b5cccdb81d6f6ad8ebeb2ca164206ad4dd0ee84f18467f932d6d7abe1df00d150ffcb354f33691d2a8f29273413e6b2dbd89a0de5c67a9fbaaf4488f75
SSDEEP 3072:jGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:am7Rkm1tYpBeh2BAoj
TLSH
T1A5C3123B5D75E83759B5BB1EB08E0A1F1DF149A2D924DE92C8D85B0837E97CC0A09D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 404140673ce8c4a5843b6f07dd25c0eaa5ddb9ab4ce7c5c06273783cd0f3e37e
MD5 278bbd500f56a285a91910bfc2505fb4
SHA1 093b6eba0c54c274990f4b52c4018d9c2495376c
SHA512 b4589f7d59575aaadfcaf5a6b75a1dfcfeeddf693049b98cc51e672ce99815970338881246726a09770c846b3cba592cc6d5009b07f87aaaf8070e36a554c334
SSDEEP 3072:DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:6m7Rkm1tYpBeh2BAoj
TLSH
T135C3123B5D65AC3759B5BB5EB08E0A1F1EF149A3D920DE92C8D85B0433E9BCD0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 27983f75d9518ed67a5a274c97cbecbf881d4e5d766e6019f53eed0ea7fa5486
MD5 eb84cf3992100584ad60675ff8fc1867
SHA1 ebae74210a6d72320fd424f4da9328967f6ded48
SHA512 8722b9df8114f19f64cf7ba266991fe7a3056183006ebedbdfa9fb4d49398e5626093006648cb5685b3f84bd44f3fd0d9c8a487e9d1fc4fe6d55dd000b2ce55c
TLSH
T15661EB323275B1D8C9167F071E6819C053BF4395EAA4AF5CB29C221EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download