660dc5bbb89e25706a79aae40fb0b3b7cfca1ccf57fcef464c7ce821ca8c677d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 681KB
Sample261108-3dadnsvtfs
SHA256 660dc5bbb89e25706a79aae40fb0b3b7cfca1ccf57fcef464c7ce821ca8c677d
MD5 9591855f7ea38c0f8a3a4221101db80f
SHA1 11cb36779b2079092a608a671fa69370d9bafd2b
SHA512 0476629dfc92f88f650988761e3407acf743a36a001120c9451d72595762235cdeda035d774dfc4df2b9c37c74216efb7ff6cc760d745071ad646a400dd03746
SSDEEP 12288:Q7BYI1c9hZOQ1joxPSb3Iu9in2YBd9RVDXtSAyY:yb1cQQCSb4u9inBBdjVBSAl
TLSH
T1D8E46B16A6E501FBD0BAE434C9970A27FE3138640324A5EB53D06A972F677E0773E391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2952	takeown.exe
1436	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2952	takeown.exe
1436	icacls.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5816	cmd.exe
4236	cmd.exe
6112	cmd.exe
3584	cmd.exe
3392	cmd.exe
4704	cmd.exe
3344	cmd.exe
1616	cmd.exe
4544	cmd.exe
1624	cmd.exe
3772	cmd.exe
4564	cmd.exe
3756	cmd.exe
2340	cmd.exe
4540	cmd.exe
5788	cmd.exe
2296	cmd.exe
4864	cmd.exe
1312	cmd.exe
6100	cmd.exe
3140	cmd.exe
1300	cmd.exe
3292	cmd.exe
1368	cmd.exe
2136	cmd.exe
4576	cmd.exe
4940	cmd.exe
5804	cmd.exe
2460	cmd.exe
3316	cmd.exe
5860	cmd.exe
1020	cmd.exe
6080	cmd.exe
5640	cmd.exe
1480	cmd.exe
4692	cmd.exe
5452	cmd.exe
4192	cmd.exe
3920	cmd.exe
3420	cmd.exe
3124	cmd.exe
1676	cmd.exe
5520	cmd.exe
776	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5816	cmd.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
4248	taskkill.exe
3476	taskkill.exe
3640	taskkill.exe
5540	taskkill.exe
3000	taskkill.exe
3884	taskkill.exe
5156	taskkill.exe
2988	taskkill.exe
2708	taskkill.exe
576	taskkill.exe
2404	taskkill.exe
2132	taskkill.exe
3664	taskkill.exe
2492	taskkill.exe
2940	taskkill.exe
6120	taskkill.exe
1012	taskkill.exe
3764	taskkill.exe
5040	taskkill.exe
2200	taskkill.exe
5424	taskkill.exe
804	taskkill.exe
4888	taskkill.exe
5668	taskkill.exe
5060	taskkill.exe
3808	taskkill.exe
4392	taskkill.exe
2636	taskkill.exe
612	taskkill.exe
3992	taskkill.exe
2632	taskkill.exe
460	taskkill.exe
6060	taskkill.exe
720	taskkill.exe
4520	taskkill.exe
4948	taskkill.exe
5964	taskkill.exe
5856	taskkill.exe
5392	taskkill.exe
4380	taskkill.exe
2564	taskkill.exe
2260	taskkill.exe
5116	taskkill.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	5156	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	460	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	612	taskkill.exe
Token: SeDebugPrivilege	5540	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	720	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	5424	taskkill.exe
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	4888	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	4948	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	5668	taskkill.exe
Token: SeDebugPrivilege	3992	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	3664	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	6120	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	5964	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeTakeOwnershipPrivilege	2952	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4236	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 4236 wrote to memory of 4392	4236	cmd.exe	91
PID 5960 wrote to memory of 3292	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 3292 wrote to memory of 1012	3292	cmd.exe	94
PID 5960 wrote to memory of 3420	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 3420 wrote to memory of 2636	3420	cmd.exe	96
PID 5960 wrote to memory of 1616	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 1616 wrote to memory of 5156	1616	cmd.exe	98
PID 5960 wrote to memory of 4576	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	99
PID 4576 wrote to memory of 2200	4576	cmd.exe	100
PID 5960 wrote to memory of 1368	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	101
PID 1368 wrote to memory of 3476	1368	cmd.exe	102
PID 5960 wrote to memory of 3124	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	103
PID 3124 wrote to memory of 460	3124	cmd.exe	104
PID 5960 wrote to memory of 3756	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	105
PID 3756 wrote to memory of 3640	3756	cmd.exe	106
PID 5960 wrote to memory of 1676	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	107
PID 1676 wrote to memory of 2988	1676	cmd.exe	108
PID 5960 wrote to memory of 6080	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	109
PID 6080 wrote to memory of 3764	6080	cmd.exe	110
PID 5960 wrote to memory of 5520	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	111
PID 5520 wrote to memory of 612	5520	cmd.exe	112
PID 5960 wrote to memory of 6112	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	113
PID 6112 wrote to memory of 5540	6112	cmd.exe	114
PID 5960 wrote to memory of 3920	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	115
PID 3920 wrote to memory of 2492	3920	cmd.exe	116
PID 5960 wrote to memory of 3584	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	117
PID 3584 wrote to memory of 6060	3584	cmd.exe	118
PID 5960 wrote to memory of 776	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	119
PID 776 wrote to memory of 720	776	cmd.exe	120
PID 5960 wrote to memory of 4544	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	121
PID 4544 wrote to memory of 4520	4544	cmd.exe	122
PID 5960 wrote to memory of 3140	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	123
PID 3140 wrote to memory of 2708	3140	cmd.exe	124
PID 5960 wrote to memory of 1480	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	125
PID 1480 wrote to memory of 5424	1480	cmd.exe	126
PID 5960 wrote to memory of 1624	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	127
PID 1624 wrote to memory of 804	1624	cmd.exe	128
PID 5960 wrote to memory of 2340	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	129
PID 2340 wrote to memory of 4888	2340	cmd.exe	130
PID 5960 wrote to memory of 4692	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	131
PID 4692 wrote to memory of 576	4692	cmd.exe	132
PID 5960 wrote to memory of 3392	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	133
PID 3392 wrote to memory of 5856	3392	cmd.exe	134
PID 5960 wrote to memory of 5452	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	135
PID 5452 wrote to memory of 3000	5452	cmd.exe	136
PID 5960 wrote to memory of 1300	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	137
PID 1300 wrote to memory of 5392	1300	cmd.exe	138
PID 5960 wrote to memory of 4940	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	139
PID 4940 wrote to memory of 2404	4940	cmd.exe	140
PID 5960 wrote to memory of 3772	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	141
PID 3772 wrote to memory of 3808	3772	cmd.exe	142
PID 5960 wrote to memory of 4192	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	143
PID 4192 wrote to memory of 5040	4192	cmd.exe	144
PID 5960 wrote to memory of 4540	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	145
PID 4540 wrote to memory of 4248	4540	cmd.exe	146
PID 5960 wrote to memory of 5788	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	147
PID 5788 wrote to memory of 2132	5788	cmd.exe	148
PID 5960 wrote to memory of 5804	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	149
PID 5804 wrote to memory of 4948	5804	cmd.exe	150
PID 5960 wrote to memory of 4704	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	151
PID 4704 wrote to memory of 2940	4704	cmd.exe	152
PID 5960 wrote to memory of 2296	5960	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	153
PID 2296 wrote to memory of 5668	2296	cmd.exe	154

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1784	attrib.exe
3176	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\MyCheat" /f
  2⤵
  PID:4844
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
  2⤵
  PID:3152
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:4200
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:3580
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
  2⤵
  - Views/modifies file attributes
  PID:1784
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
  2⤵
  - Views/modifies file attributes
  PID:3176
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:1020