c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458

Analysis

user interaction
yes
max time kernel
72s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decomBuild_Slayed.exe
Size 1.7MB
Sample261017-qjdl3atzay
SHA256 c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458
MD5 5675afb5a96f73ba44143bf0d7eb1f48
SHA1 d2a5c460cefe31fb069298ef30b3b608a9751b4f
SHA512 457cc310044159e30d186a53176acf9cd155d8ac8265a5ac019f30114a278e3da34b4a1ca5a08f925390c5d2c05bb03f9522fb09e0e5be93b773dc9bbbd12fa8
SSDEEP 24576:Xktz2I9NXzgGjTybBltfLJ9ZLJ4GCBr8nvRj6U0IgDBcj+oKac5:XktzbXsb1JnjAcv9gDBw+oKa
TLSH
T1A9858D8233C28D62D57F67339B22924029E8EF115B93C71ED86F47B73E53BA4A4651C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
43	4668	Process not Found
46	4668	Process not Found
48	4668	Process not Found
49	4668	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5856	powershell.exe
5060	powershell.exe
5820	powershell.exe
1044	powershell.exe
4716	powershell.exe
5008	powershell.exe
2304	powershell.exe
1540	powershell.exe
5964	powershell.exe
4904	powershell.exe
5624	powershell.exe
5676	powershell.exe
4940	powershell.exe
2524	powershell.exe
4892	powershell.exe
3820	powershell.exe
4696	powershell.exe
1912	powershell.exe
972	powershell.exe
4632	powershell.exe
5648	powershell.exe
228	powershell.exe
5368	powershell.exe
4136	powershell.exe
1736	powershell.exe
1380	powershell.exe
1784	powershell.exe
5968	powershell.exe
1116	powershell.exe
972	powershell.exe
2592	powershell.exe
2512	powershell.exe
3028	powershell.exe
6108	powershell.exe
1292	powershell.exe
5652	powershell.exe
4956	powershell.exe
3592	powershell.exe
2932	powershell.exe
4028	powershell.exe
2656	powershell.exe
892	powershell.exe
6052	powershell.exe
4856	powershell.exe
400	powershell.exe
2780	powershell.exe
4100	powershell.exe
1760	powershell.exe
6068	powershell.exe
2292	powershell.exe
5648	powershell.exe
5100	powershell.exe
3540	powershell.exe
1132	powershell.exe
220	powershell.exe
2084	powershell.exe
4832	powershell.exe
6004	powershell.exe
4240	powershell.exe
2592	powershell.exe
5804	powershell.exe
2488	powershell.exe
3960	powershell.exe
5020	powershell.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x00070000000285c6-24.dat	net_reactor
behavioral1/files/0x002f000000000367-1701.dat	net_reactor

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Control Panel\International\Geo\Nation	decomBuild_Slayed.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	decomBuild_Slayed.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	msedgewebview3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	msedgewebview3.exe

Executes dropped EXE 3 IoCs

pid	Process
768	msedgewebview3.exe
2396	msedgewebview3.exe
5016	msedgewebview3.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	msedgewebview3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	decomBuild_Slayed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	msedgewebview3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
61	discord.com
40	discord.com
41	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 32 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
52	api.ipify.org
5	api.ipify.org
25	ip-api.com
29	ip-api.com
30	ipinfo.io
54	ip-api.com
85	ip-api.com
96	ipinfo.io
53	ip-api.com
57	ip-api.com
84	ip-api.com
90	ip-api.com
95	ip-api.com
7	ip-api.com
20	ipinfo.io
24	api.ipify.org
58	ipinfo.io
92	ip-api.com
81	api.ipify.org
83	ip-api.com
86	ipinfo.io
14	api.ipify.org
19	ip-api.com
82	ip-api.com
88	api.ipify.org
6	api.ipify.org
8	ip-api.com
13	ip-api.com
17	ip-api.com
18	ip-api.com
21	ipinfo.io
28	ip-api.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4136	powershell.exe
5028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3484	cmd.exe
5824	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	decomBuild_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	decomBuild_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1404	timeout.exe
5804	timeout.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4136	reg.exe
4216	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe
4232	schtasks.exe
1056	schtasks.exe
4900	schtasks.exe
5460	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
2396	msedgewebview3.exe
2396	msedgewebview3.exe
5016	msedgewebview3.exe
5016	msedgewebview3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	decomBuild_Slayed.exe
4240	powershell.exe
4240	powershell.exe
892	powershell.exe
892	powershell.exe
768	msedgewebview3.exe
2356	powershell.exe
2356	powershell.exe
3428	powershell.exe
3428	powershell.exe
4392	powershell.exe
768	msedgewebview3.exe
768	msedgewebview3.exe
768	msedgewebview3.exe
768	msedgewebview3.exe
4392	powershell.exe
1760	powershell.exe
1760	powershell.exe
2488	powershell.exe
2488	powershell.exe
4028	powershell.exe
4028	powershell.exe
1784	powershell.exe
1784	powershell.exe
768	msedgewebview3.exe
768	msedgewebview3.exe
768	msedgewebview3.exe
768	msedgewebview3.exe
4292	powershell.exe
4292	powershell.exe
4280	powershell.exe
4280	powershell.exe
2396	msedgewebview3.exe
3936	powershell.exe
3936	powershell.exe
820	powershell.exe
820	powershell.exe
2052	powershell.exe
2396	msedgewebview3.exe
2396	msedgewebview3.exe
2396	msedgewebview3.exe
2396	msedgewebview3.exe
2052	powershell.exe
3960	powershell.exe
3960	powershell.exe
1512	powershell.exe
1512	powershell.exe
5368	powershell.exe
5368	powershell.exe
4100	powershell.exe
4100	powershell.exe
2396	msedgewebview3.exe
2396	msedgewebview3.exe
2396	msedgewebview3.exe
2396	msedgewebview3.exe
3404	powershell.exe
3404	powershell.exe
4360	powershell.exe
4360	powershell.exe
1132	powershell.exe
1132	powershell.exe
1540	powershell.exe
1540	powershell.exe
2396	msedgewebview3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	decomBuild_Slayed.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeIncreaseQuotaPrivilege	4240	powershell.exe
Token: SeSecurityPrivilege	4240	powershell.exe
Token: SeTakeOwnershipPrivilege	4240	powershell.exe
Token: SeLoadDriverPrivilege	4240	powershell.exe
Token: SeSystemProfilePrivilege	4240	powershell.exe
Token: SeSystemtimePrivilege	4240	powershell.exe
Token: SeProfSingleProcessPrivilege	4240	powershell.exe
Token: SeIncBasePriorityPrivilege	4240	powershell.exe
Token: SeCreatePagefilePrivilege	4240	powershell.exe
Token: SeBackupPrivilege	4240	powershell.exe
Token: SeRestorePrivilege	4240	powershell.exe
Token: SeShutdownPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeSystemEnvironmentPrivilege	4240	powershell.exe
Token: SeRemoteShutdownPrivilege	4240	powershell.exe
Token: SeUndockPrivilege	4240	powershell.exe
Token: SeManageVolumePrivilege	4240	powershell.exe
Token: 33	4240	powershell.exe
Token: 34	4240	powershell.exe
Token: 35	4240	powershell.exe
Token: 36	4240	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeIncreaseQuotaPrivilege	892	powershell.exe
Token: SeSecurityPrivilege	892	powershell.exe
Token: SeTakeOwnershipPrivilege	892	powershell.exe
Token: SeLoadDriverPrivilege	892	powershell.exe
Token: SeSystemProfilePrivilege	892	powershell.exe
Token: SeSystemtimePrivilege	892	powershell.exe
Token: SeProfSingleProcessPrivilege	892	powershell.exe
Token: SeIncBasePriorityPrivilege	892	powershell.exe
Token: SeCreatePagefilePrivilege	892	powershell.exe
Token: SeBackupPrivilege	892	powershell.exe
Token: SeRestorePrivilege	892	powershell.exe
Token: SeShutdownPrivilege	892	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeSystemEnvironmentPrivilege	892	powershell.exe
Token: SeRemoteShutdownPrivilege	892	powershell.exe
Token: SeUndockPrivilege	892	powershell.exe
Token: SeManageVolumePrivilege	892	powershell.exe
Token: 33	892	powershell.exe
Token: 34	892	powershell.exe
Token: 35	892	powershell.exe
Token: 36	892	powershell.exe
Token: SeDebugPrivilege	768	msedgewebview3.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeIncreaseQuotaPrivilege	2356	powershell.exe
Token: SeSecurityPrivilege	2356	powershell.exe
Token: SeTakeOwnershipPrivilege	2356	powershell.exe
Token: SeLoadDriverPrivilege	2356	powershell.exe
Token: SeSystemProfilePrivilege	2356	powershell.exe
Token: SeSystemtimePrivilege	2356	powershell.exe
Token: SeProfSingleProcessPrivilege	2356	powershell.exe
Token: SeIncBasePriorityPrivilege	2356	powershell.exe
Token: SeCreatePagefilePrivilege	2356	powershell.exe
Token: SeBackupPrivilege	2356	powershell.exe
Token: SeRestorePrivilege	2356	powershell.exe
Token: SeShutdownPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeSystemEnvironmentPrivilege	2356	powershell.exe
Token: SeRemoteShutdownPrivilege	2356	powershell.exe
Token: SeUndockPrivilege	2356	powershell.exe
Token: SeManageVolumePrivilege	2356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4964	4768	decomBuild_Slayed.exe	83
PID 4768 wrote to memory of 5084	4768	decomBuild_Slayed.exe	86
PID 4768 wrote to memory of 4240	4768	decomBuild_Slayed.exe	88
PID 4768 wrote to memory of 1108	4768	decomBuild_Slayed.exe	90
PID 4768 wrote to memory of 892	4768	decomBuild_Slayed.exe	93
PID 4768 wrote to memory of 4544	4768	decomBuild_Slayed.exe	94
PID 4768 wrote to memory of 3212	4768	decomBuild_Slayed.exe	97
PID 768 wrote to memory of 4856	768	msedgewebview3.exe	101
PID 4768 wrote to memory of 4232	4768	decomBuild_Slayed.exe	103
PID 4768 wrote to memory of 2356	4768	decomBuild_Slayed.exe	105
PID 4768 wrote to memory of 460	4768	decomBuild_Slayed.exe	107
PID 768 wrote to memory of 4000	768	msedgewebview3.exe	109
PID 768 wrote to memory of 3428	768	msedgewebview3.exe	111
PID 4768 wrote to memory of 4392	4768	decomBuild_Slayed.exe	113
PID 768 wrote to memory of 1760	768	msedgewebview3.exe	115
PID 4768 wrote to memory of 2488	4768	decomBuild_Slayed.exe	117
PID 4768 wrote to memory of 1056	4768	decomBuild_Slayed.exe	119
PID 4768 wrote to memory of 2364	4768	decomBuild_Slayed.exe	121
PID 768 wrote to memory of 4028	768	msedgewebview3.exe	123
PID 4768 wrote to memory of 1784	4768	decomBuild_Slayed.exe	125
PID 768 wrote to memory of 4292	768	msedgewebview3.exe	127
PID 4768 wrote to memory of 4280	4768	decomBuild_Slayed.exe	129
PID 4768 wrote to memory of 2396	4768	decomBuild_Slayed.exe	131
PID 2396 wrote to memory of 5108	2396	msedgewebview3.exe	132
PID 4768 wrote to memory of 3936	4768	decomBuild_Slayed.exe	134
PID 2396 wrote to memory of 4236	2396	msedgewebview3.exe	136
PID 2396 wrote to memory of 820	2396	msedgewebview3.exe	138
PID 4768 wrote to memory of 2052	4768	decomBuild_Slayed.exe	140
PID 2396 wrote to memory of 3960	2396	msedgewebview3.exe	142
PID 4768 wrote to memory of 3484	4768	decomBuild_Slayed.exe	144
PID 3484 wrote to memory of 1404	3484	cmd.exe	146
PID 4768 wrote to memory of 1512	4768	decomBuild_Slayed.exe	147
PID 2396 wrote to memory of 5368	2396	msedgewebview3.exe	149
PID 4768 wrote to memory of 4100	4768	decomBuild_Slayed.exe	151
PID 2396 wrote to memory of 3404	2396	msedgewebview3.exe	153
PID 4768 wrote to memory of 4360	4768	decomBuild_Slayed.exe	155
PID 3484 wrote to memory of 4136	3484	cmd.exe	157
PID 2396 wrote to memory of 1132	2396	msedgewebview3.exe	209
PID 4768 wrote to memory of 6128	4768	decomBuild_Slayed.exe	160
PID 2396 wrote to memory of 1540	2396	msedgewebview3.exe	162
PID 2396 wrote to memory of 4692	2396	msedgewebview3.exe	164
PID 2396 wrote to memory of 6044	2396	msedgewebview3.exe	168
PID 2396 wrote to memory of 3348	2396	msedgewebview3.exe	171
PID 2396 wrote to memory of 5020	2396	msedgewebview3.exe	173
PID 2396 wrote to memory of 5964	2396	msedgewebview3.exe	175
PID 2396 wrote to memory of 3272	2396	msedgewebview3.exe	177
PID 2396 wrote to memory of 3080	2396	msedgewebview3.exe	179
PID 2396 wrote to memory of 1804	2396	msedgewebview3.exe	182
PID 2396 wrote to memory of 6068	2396	msedgewebview3.exe	184
PID 2396 wrote to memory of 4544	2396	msedgewebview3.exe	186
PID 2396 wrote to memory of 4448	2396	msedgewebview3.exe	188
PID 2396 wrote to memory of 2116	2396	msedgewebview3.exe	191
PID 2396 wrote to memory of 4728	2396	msedgewebview3.exe	193
PID 2396 wrote to memory of 2656	2396	msedgewebview3.exe	195
PID 2396 wrote to memory of 2292	2396	msedgewebview3.exe	197
PID 2396 wrote to memory of 1064	2396	msedgewebview3.exe	200
PID 2396 wrote to memory of 3492	2396	msedgewebview3.exe	202
PID 2396 wrote to memory of 4024	2396	msedgewebview3.exe	204
PID 2396 wrote to memory of 5856	2396	msedgewebview3.exe	206
PID 2396 wrote to memory of 5108	2396	msedgewebview3.exe	208
PID 2396 wrote to memory of 1912	2396	msedgewebview3.exe	210
PID 2396 wrote to memory of 1116	2396	msedgewebview3.exe	212
PID 2396 wrote to memory of 5648	2396	msedgewebview3.exe	214
PID 2396 wrote to memory of 4028	2396	msedgewebview3.exe	216

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:5084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4240
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4544
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:3212
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1056
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
  "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /query /fo CSV /nh
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:4236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:6044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5108
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9xB4hR8U.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1404
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\0" /f
    3⤵
    - Modifies registry key
    PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe"
  2⤵
  PID:6128

C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:4856
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
PID:5016
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:1056
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
  2⤵
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5676
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:6100
- C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe
  "C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe"
  2⤵
  PID:2912
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:1500
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3" /f
    3⤵
    PID:4176
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:2024
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:3136
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:4140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4136
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:4944
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:4848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe'"
    3⤵
    PID:3792
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:4164
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3_logon" /fo CSV /nh
    3⤵
    PID:3824
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "msedgewebview3_logon" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5460
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:3516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
    "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
    3⤵
    PID:3524
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
      4⤵
      PID:4852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
      4⤵
      PID:1148
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
      4⤵
      PID:5140
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3_logon" /fo CSV /nh
      4⤵
      PID:5268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
      4⤵
      PID:3372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
      4⤵
      PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\ihe7crOh.exe
      "C:\Users\Admin\AppData\Local\Temp\ihe7crOh.exe" --selfupdate
      4⤵
      PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
    3⤵
    PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DPocnnCw.bat""
    3⤵
    - Executes a command shell one-liner
    PID:5824
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5804
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe\0" /f
      4⤵
      Modifies registry key
      PID:4216
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\ROVjb8SQ.exe"
    3⤵
    PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4664

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedgewebview3.exe

Path C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
Size 1.7MB
SHA256 c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458
MD5 5675afb5a96f73ba44143bf0d7eb1f48
SHA1 d2a5c460cefe31fb069298ef30b3b608a9751b4f
SHA512 457cc310044159e30d186a53176acf9cd155d8ac8265a5ac019f30114a278e3da34b4a1ca5a08f925390c5d2c05bb03f9522fb09e0e5be93b773dc9bbbd12fa8
SSDEEP 24576:Xktz2I9NXzgGjTybBltfLJ9ZLJ4GCBr8nvRj6U0IgDBcj+oKac5:XktzbXsb1JnjAcv9gDBw+oKa
TLSH
T1A9858D8233C28D62D57F67339B22924029E8EF115B93C71ED86F47B73E53BA4A4651C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download