7406ecfc47f50432c61e271d7545b94e1e29de023efa268e8eee099dd66868b2

Analysis

max time kernel
151s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
Size 49.7MB
Sample260806-jk9bss1thy
SHA256 7406ecfc47f50432c61e271d7545b94e1e29de023efa268e8eee099dd66868b2
MD5 a35b3b6733ee68a6880969314f2872e0
SHA1 d2dc6053065a36828811f8f309c90147a30d9f63
SHA512 ac55089204feea1d79018c420787e780257dcfec15e6017757937fae5b19d0fb778483e6279fa1af100e7c974737b609eb30ceb063426f652b0735c86dddad77
SSDEEP 393216:JCq/a3I9cGSHDGhAriW1CPwDv3uFhtU2lvz4JeoAfWQuzJkO0IZaKKFRVIIANhsZ:J2I9cG3BeKMkLE/A
TLSH
T1C6B79D1163950095F677D0798927BA13EFB5BC6A13D412C731A8F6A82F33ED12BBE640
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Loads dropped DLL 25 IoCs

pid	Process
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1796	cmd.exe
3624	cmd.exe
3464	cmd.exe
4396	cmd.exe
5848	cmd.exe
5936	cmd.exe
3356	cmd.exe
3392	cmd.exe
5872	cmd.exe
356	cmd.exe
2284	cmd.exe
1920	cmd.exe
4376	cmd.exe
1124	cmd.exe
3632	cmd.exe
6040	cmd.exe
952	cmd.exe
5076	cmd.exe
3128	cmd.exe
2376	cmd.exe
5996	cmd.exe
4076	cmd.exe
4372	cmd.exe
3348	cmd.exe
3772	cmd.exe
4660	cmd.exe
1328	cmd.exe
3400	cmd.exe
1336	cmd.exe
4532	cmd.exe
5200	cmd.exe
1224	cmd.exe
1652	cmd.exe
5072	cmd.exe
2076	cmd.exe
1196	cmd.exe
1828	cmd.exe
3388	cmd.exe
4992	cmd.exe
5480	cmd.exe
3728	cmd.exe
4648	cmd.exe
1076	cmd.exe
3092	cmd.exe
5948	cmd.exe
5676	cmd.exe
2736	cmd.exe
5368	cmd.exe
4932	cmd.exe
4728	cmd.exe
1820	cmd.exe
5384	cmd.exe
876	cmd.exe
5836	cmd.exe
5404	cmd.exe
5888	cmd.exe
5564	cmd.exe
1060	cmd.exe
4140	cmd.exe
988	cmd.exe
4124	cmd.exe
3828	cmd.exe
4580	cmd.exe
4944	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
2596	taskkill.exe
4412	taskkill.exe
3224	taskkill.exe
5392	taskkill.exe
4632	taskkill.exe
5252	taskkill.exe
4788	taskkill.exe
5828	taskkill.exe
5176	taskkill.exe
1360	taskkill.exe
2812	taskkill.exe
2692	taskkill.exe
5028	taskkill.exe
5796	taskkill.exe
5036	taskkill.exe
6056	taskkill.exe
2152	taskkill.exe
3576	taskkill.exe
5544	taskkill.exe
4328	taskkill.exe
3928	taskkill.exe
2772	taskkill.exe
3280	taskkill.exe
3428	taskkill.exe
3960	taskkill.exe
5612	taskkill.exe
4312	taskkill.exe
1324	taskkill.exe
4852	taskkill.exe
4324	taskkill.exe
5912	taskkill.exe
1364	taskkill.exe
4732	taskkill.exe
2612	taskkill.exe
3872	taskkill.exe
1684	taskkill.exe
248	taskkill.exe
4296	taskkill.exe
2564	taskkill.exe
5336	taskkill.exe
5868	taskkill.exe
2016	taskkill.exe
2788	taskkill.exe
1324	taskkill.exe
4812	taskkill.exe
5704	taskkill.exe
2892	taskkill.exe
3224	taskkill.exe
4652	taskkill.exe
4640	taskkill.exe
964	taskkill.exe
4812	taskkill.exe
1608	taskkill.exe
1988	taskkill.exe
3036	taskkill.exe
2360	taskkill.exe
5472	taskkill.exe
6100	taskkill.exe
2108	taskkill.exe
1236	taskkill.exe
3636	taskkill.exe
3048	taskkill.exe
1248	taskkill.exe
3504	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeDebugPrivilege	3416	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	964	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	3060	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	5508	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	1368	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	1684	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	5440	taskkill.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	6052	taskkill.exe
Token: SeDebugPrivilege	3624	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	5408	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	248	taskkill.exe
Token: SeDebugPrivilege	1192	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	2300	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	5708	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	3636	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe
Token: SeDebugPrivilege	3784	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 5388	5004	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	89
PID 5388 wrote to memory of 4164	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	90
PID 4164 wrote to memory of 2836	4164	cmd.exe	92
PID 5388 wrote to memory of 1060	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	94
PID 1060 wrote to memory of 3808	1060	cmd.exe	96
PID 5388 wrote to memory of 3420	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	97
PID 3420 wrote to memory of 3416	3420	cmd.exe	99
PID 5388 wrote to memory of 5112	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	100
PID 5112 wrote to memory of 1488	5112	cmd.exe	102
PID 5388 wrote to memory of 4104	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	103
PID 4104 wrote to memory of 4788	4104	cmd.exe	105
PID 5388 wrote to memory of 4140	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	106
PID 4140 wrote to memory of 5364	4140	cmd.exe	108
PID 5388 wrote to memory of 2792	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	109
PID 2792 wrote to memory of 5324	2792	cmd.exe	111
PID 5388 wrote to memory of 3388	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	112
PID 3388 wrote to memory of 3872	3388	cmd.exe	114
PID 5388 wrote to memory of 1328	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	115
PID 1328 wrote to memory of 3928	1328	cmd.exe	117
PID 5388 wrote to memory of 4072	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	118
PID 4072 wrote to memory of 2788	4072	cmd.exe	120
PID 5388 wrote to memory of 2972	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	121
PID 2972 wrote to memory of 964	2972	cmd.exe	123
PID 5388 wrote to memory of 6024	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	124
PID 6024 wrote to memory of 4908	6024	cmd.exe	126
PID 5388 wrote to memory of 1432	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	127
PID 1432 wrote to memory of 5660	1432	cmd.exe	129
PID 5388 wrote to memory of 5664	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	130
PID 5664 wrote to memory of 5880	5664	cmd.exe	132
PID 5388 wrote to memory of 2428	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	133
PID 2428 wrote to memory of 1072	2428	cmd.exe	135
PID 5388 wrote to memory of 3400	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	136
PID 3400 wrote to memory of 2772	3400	cmd.exe	138
PID 5388 wrote to memory of 4432	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	139
PID 4432 wrote to memory of 3060	4432	cmd.exe	141
PID 5388 wrote to memory of 4796	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	142
PID 4796 wrote to memory of 2876	4796	cmd.exe	144
PID 5388 wrote to memory of 5948	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	145
PID 5948 wrote to memory of 5508	5948	cmd.exe	147
PID 5388 wrote to memory of 4824	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	148
PID 4824 wrote to memory of 3816	4824	cmd.exe	150
PID 5388 wrote to memory of 2744	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	151
PID 2744 wrote to memory of 1368	2744	cmd.exe	153
PID 5388 wrote to memory of 1880	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	154
PID 1880 wrote to memory of 5468	1880	cmd.exe	156
PID 5388 wrote to memory of 1860	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	157
PID 1860 wrote to memory of 5624	1860	cmd.exe	159
PID 5388 wrote to memory of 5788	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	160
PID 5788 wrote to memory of 2648	5788	cmd.exe	162
PID 5388 wrote to memory of 2840	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	163
PID 2840 wrote to memory of 1684	2840	cmd.exe	165
PID 5388 wrote to memory of 5676	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	166
PID 5676 wrote to memory of 4892	5676	cmd.exe	168
PID 5388 wrote to memory of 5560	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	169
PID 5560 wrote to memory of 5440	5560	cmd.exe	171
PID 5388 wrote to memory of 5648	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	172
PID 5648 wrote to memory of 5392	5648	cmd.exe	174
PID 5388 wrote to memory of 3128	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	175
PID 3128 wrote to memory of 2596	3128	cmd.exe	177
PID 5388 wrote to memory of 5244	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	178
PID 5244 wrote to memory of 1280	5244	cmd.exe	180
PID 5388 wrote to memory of 2736	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	181
PID 2736 wrote to memory of 4100	2736	cmd.exe	183
PID 5388 wrote to memory of 5368	5388	2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-06_a35b3b6733ee68a6880969314f2872e0_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:6120
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:988
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1396
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1920
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5064
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3164
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4144
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3348
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3912
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4456
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2264
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1700
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5556
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5936
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2244
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3704
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:6044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4964
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2808
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3392
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4556
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3316
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2396
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4316
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1116
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:6056
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1196
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3056
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:6112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5872
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3808
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4396
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:6136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5536
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2292
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1684
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2212
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2824
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1560
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:1488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\81d243bd2c585b0f4821__mypyc.pyd
Size 207KB
SHA256 9e1ae7ab6b61843c9024448c9d5f364bb24426e4e3135affff3db5bc7b383863
MD5 2bd0017bcffe1d3e40fba1496c7d1e07
SHA1 f46d998003c36c381e184e846744c2099dce622c
SHA512 929735779e8ff27f064f85d4cf85fc4a540cb88cd7851704922bee5e5e191b6989b540134ae44853b5120d962d5ee402296bea6ca150ea6f2ec32d1c509ffd67
SSDEEP 6144:zKQoAJlMiEA/JcBxkP8VXaVlaz8fnt4HtFmiGJ1MIOw+Dvf:zToliV/qLz
TLSH
T16224293952480020EC774279CC679527E9B2F662073552CF09D0C6796F26BFAB7BDB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\PIL\_imaging.pyd
Size 2.4MB
SHA256 f76a23005363179d9d0a0ca31dfbaebf9a44a0aa37b646fc6d954d9fb06a74a7
MD5 5a39b827fb1e65ada95be7b54f4608de
SHA1 4c3e40bf453bc3d7de3d989d91b4c8d2323c2c44
SHA512 901520194c46e5cb3680769298ec3c389db8409aabdce475b50818d33403280fb2eb5888a0809005e0410234ffe06ec877ed00ac0a69c3537f22b44f65304bc0
SSDEEP 49152:Bv+xpdoSj/jDg4UOfq2ptoKDCkjlLL/ZTGcMVK:/is2dDdlLLo1
TLSH
T1D7B56B06E9E19595C6B28034CDABD112E3B1B81D17F186F77684A6F83F23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\_bz2.pyd
Size 85KB
SHA256 c0dd9496b19ba9536a78a43a97704e7d4bef3c901d196ed385e771366682819d
MD5 b024a6f227eafa8d43edfc1a560fe651
SHA1 92451be6a2a6bfc4a8de8ad3559ba4a25d409f2e
SHA512 b9edb6d0f1472dd01969e6f160b41c1e7e935d4eebcaf08554195eb85d91c19ff1bfbc150773f197462e582c6d31f12bd0304f636eb4f189ed3ed976824b283e
SSDEEP 1536:bBVEz7G6jRTRdDsyKzogNC1Ue3FF2Ol8AOP1ipVIWtVA7SynY:N6znFihztuUe3iOKAg1ipVIWtVAxY
TLSH
T137837C92B3A1A6B4F49BB2789661034BD331B91D0390D3AF6364826F2F12F417D6671E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\_hashlib.pyd
Size 64KB
SHA256 c5b8c4582e201fef2d8cb2c8672d07b86dec31afb4a17b758dbfb2cff163b12f
MD5 69dc506cf2fa3da9d0caba05fca6a35d
SHA1 33b24abb7b1d68d3b0315be7f8f49de50c9bdcb6
SHA512 0009ec88134e25325a47b8b358da0fed8bb34fe80602e08a60686f6029b80f4287d33adb66ef41435d11d6edff86a88916f776eeaf2d1cb72035783f109ca1ff
SSDEEP 1536:v2UsyQLwkpuRYqVcXP7eRzozEDvZhjqtIW5IX7SyYEkb:v2gSP7AZhjqtIW5IX2Ekb
TLSH
T1E1536C4AA78640A9C87382B9D8A30F57EA72F4411310A7DF4274C24D2F137E7A7B7B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\_lzma.pyd
Size 160KB
SHA256 6e571d93ce55d09583ec91c607883a43c1da3d4d36794d68c6ecd6bea4ab466a
MD5 77b78b43d58fe7ce9eb2fbb1420889fa
SHA1 de55ce88854e314697fa54703a2cd6cc970f3111
SHA512 7b03b7d3f2fd9b51391de08e69ca9156a0232b56f210878a488b9d5a19492ab5880f45d9407331360fbe543a52c03d68f68da4387bf6a13b20ec903a7b081846
SSDEEP 3072:eKV4saZRa8UGlxUgmqfU78IzbYCUQznfo9mNoJnkZ4rtSVIWe1pk8sc:eKV4saZg8UMUgm/88UGwYOJnRrYq
TLSH
T1B1F34A96B394F0E5F3328C38DA624F17D6F578190320929A02CD876D2B1F7759A2B727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\_socket.pyd
Size 79KB
SHA256 9e97b782b55400e5a914171817714bbbc713c0a396e30496c645fc82835e4b34
MD5 cd56f508e7c305d4bfdeb820ecf3a323
SHA1 711c499bcf780611a815afa7374358bbfd22fcc9
SHA512 e937c322c78e40947c70413404beba52d3425945b75255590dedf84ee429f685e0e5bc86ad468044925fbc59cf7ec8698a5472dd4f05b4363da30de04f9609a5
SSDEEP 1536:xBCJoimjxvExWxAh9/s+++pmj1XmrpZxP4cJIWQwh7Sy21:6ai6lfAh9/sT+pcmrbjJIWQwhY1
TLSH
T1A3836B11A6A051B9D673D0B6C5679F23F7B0F4801394938F5160CA2E1F23782AF7EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\_ssl.pyd
Size 153KB
SHA256 d318795c98c5f3c127c8e47220a92acba0736daf31bab0dc9c7e6c3513bb2aa3
MD5 70014e88ecf3133b7be097536f77b459
SHA1 5d75675bb35ba6fae774937789491e051e62a252
SHA512 aa59b32c9164afca1b799e389c7087e95eeaa543790b6f590f9e30aa13b7fdb8cc83d0ef6351f0b578a4da636f4ca1e6dfe4558dcf3a813b744a80f7392aa462
SSDEEP 3072:d+W/EKFRXUxwSYQyDiyqoIpy07nhpcgs2W74DH70NmHh4kwooSLteSdN1SGwVIWH:dGKFRXUxrZyDHKjhpS743DthN1SGwjL
TLSH
T1B5E37D43B6841AB7E813E4BDC6630A02D7B8F144231157DE45D6DA4A0F03B46BE6BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\_tkinter.pyd
Size 65KB
SHA256 313fb33e72028fcc893ec7874e0c825c035cdcebe1b5b7c7d8d11ef3ad1b354f
MD5 77cf63868cae43963b69b4561114cd19
SHA1 6975afa15fde28279ede93c78d78847ed58d6221
SHA512 fcf92377b07a2979b87cce7f545dd5f34df8739e2634d889077a10bb4441853b24a9427fa92ed5cb4694e71ef6421f89e1106bd689f94d11d839e29f576af514
SSDEEP 1536:E5Ht4gTDqcDfY181C3sLS7IjuftIW5SY7SyRom0:E5egTDqxp8LS7IjctIW5SYwm0
TLSH
T19D636BA76794009ADEA7C13DC4726F23D675B8210A20938F4194C31A1F677A3B7FAB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

banner.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\banner.dll
Size 14.2MB
SHA256 582b73a2ad8fdf092853ede0b72638f439514f75a741f52e0157c41938b3525a
MD5 2831b21dffd7d77bc389dfb8ee4bef08
SHA1 8c27ecb45a264858f3aa836594416ead0aa14af2
SHA512 e762157aebb17685ba130e92c52883bcd51ea442a2989737b37c0899721c37d6e7ae0656bcbe657ca453686c83215c7de8638c81ecf2669448ba35e22396ba19
SSDEEP 196608:4OVyfKE70w8F6G80Ie7/rI9UWMr5k17YE:4Cq/a3I9c
TLSH
T19DE63B5623901547FFB6F1B58D69DA23EFB1B4AE13183693309CC6983B46CE62BED044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\charset_normalizer\cd.pyd
Size 9KB
SHA256 57c141446fb8b88012eef18a789e626be653b759ebe26f0af2b4d97ede852d98
MD5 96a8a1e8da4601905f79f6dc0fec89f8
SHA1 5946ba13be06236c0e16b2206dbafe9838472ebb
SHA512 5d3cdb45834f4bcc3bb9d85e279578eca425d954c7af6c4512da304c8d491854eb6b4004ee75083da6c7b2dfede5a1e2754920c95e0eb8e26f37f120e46d2872
SSDEEP 96:gOCFmxLF1JlitlV6GxQtRiuLnBHXHbJchltZEUG3MAqhAixN8KFo9HfF9To:5xRdit36GxaLnB37JcdZLN8Ku9HfF
TLSH
T19312D759B79588FAD639013CC5BB0F497078BB204B1227CF13B1A92D1D63BCB513AA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\charset_normalizer\md.pyd
Size 9KB
SHA256 8f764e5cc42240b285c0699f83751f8db955f113c73d965f9855988e99978e64
MD5 e7d6b52016fc64ca0f026662ce686bf7
SHA1 a14b078d51df8d26b178c3efd08cb0934cd49284
SHA512 eae7862379fda970c68784ba89ae95f638f24d036b9d5ce4319bec173ba28836304f432e7832303e157bb30ce9992e5e37fbcf37b87019e871908330722fd676
SSDEEP 96:lOCFmxLF1JlitlV6GxQtRiuLnBHXHbJchltZEUE3tAqhAg3N8KFo9HfF9To:axRdit36GxaLnB37JcdZWN8Ku9HfF
TLSH
T1DD12D799B7958CF6D639023CC5BB0F597078BB205B1267CF13B1A9291D63BCF513AA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
TLSH
T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
TLSH
T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementpath.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\lxml\_elementpath.pyd
Size 139KB
SHA256 e24c24e0968b4168f1abff4ccaae5d0c65e97fcd926c0dadd5973c7dd9d132fb
MD5 2850aa57400f7cac9ce99a958d5cbfe8
SHA1 c01ad4a46a5082f74b9f858f3b12fe378f839f1b
SHA512 495a7120aac8e5486740e708b5b71853c20bd23f92773ea3fbdc58e155267fed3970096f1bd00a99214c6d5f36934f547cbed89c875ad629aa214c519340a34b
SSDEEP 3072:yANUoWbxec/mWADNjwWlpLOJfmPUhfdy:yAUoWbxecIDNBlpLWmUG
TLSH
T122D3392A72E84085E6A791788C279912FBB7B05427086BCF0590D7582F63EE67FFD341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etree.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\lxml\etree.pyd
Size 3.8MB
SHA256 3043b25b6ba66e5ad6c91f9c41f153d3f74737d6c9c48673969cb504c7227216
MD5 196b334453b919e87425b40296a50ed6
SHA1 4c250513080c9eb9e674b20393ef32c7c12b429c
SHA512 9501760d94e62c5bcaa6e90ae34e4e5660c7bcf35e5dd98d109059922da367852e051a7cd536a15f0e9a870555beb59368395e542f13991d74c801f8cfa88f36
SSDEEP 49152:6Cpg6x1ReKZqQbzzkdvYm2XoEv1iLDFtRDPzKCLtDKozuqEELMHluohbBAUZLYqP:vzM8ZRoCbBAUZL
TLSH
T120169E12A3E41065D66BC1788D675613EBB2BC052B246BCB2064F6692F73FE213FDB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\python3.dll
Size 59KB
SHA256 5a2f39ed041d35bb48e89c72c1ad16a5a24a3674f8eb34bfbc6310fd75128f16
MD5 4a776941c0aa723c50223cb1a19e6d02
SHA1 08e4cdf06f3b9ee5f9d5c865b49c808d20938583
SHA512 0319030bd2b51bf605c8ef4324eacf3a1f2e2315c92bc0cfc8e9eb7df72038f6c377b9537fec16470363499e6e0dbb7ca164169ae43601294310f84e53a06881
SSDEEP 768:Kn+mYEBMcEfpzVHBlAUcfc0la6Wc6kH/ZFJ1Yu+wNBECaOMyCgUhkb0E/GhJIWQi:K+mYEBMofwkAJIWQ077SybdR
TLSH
T19C5380525894FCA3DBEA2DFF78D19DC914E912CC812684DCB97892930F5A233AD2734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\python39.dll
Size 4.3MB
SHA256 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
MD5 2135da9f78a8ef80850fa582df2c7239
SHA1 aac6ad3054de6566851cae75215bdeda607821c4
SHA512 423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369
SSDEEP 49152:icfsV4WJ+NXBzGcS5V7Du7RHEYNf/OpEQZIMKKx+qNIowg1h9MKpj4ZkYMCfmUIS:6JeB1SDaZf/7Ns9MLZfERUHRMXIwNKX
TLSH
T1D3267C22A3941194DAB78477C5278746DBF2FC502B20E34B41A4BAD52F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\select.pyd
Size 29KB
SHA256 71ed480da28968a7fd07934e222ae87d943677468936fd419803280d0cad07f3
MD5 35bb285678b249770dda3f8a15724593
SHA1 a91031d56097a4cbf800a6960e229e689ba63099
SHA512 956759742b4b47609a57273b1ea7489ce39e29ebced702245a9665bb0479ba7d42c053e40c6dc446d5b0f95f8cc3f2267af56ccaaaf06e6875c94d4e3f3b6094
SSDEEP 768:HYyAU1265whz9HqRORWJIW7G1YiSyv4eED:z86GhhKRORWJIW7G17SygR
TLSH
T161D26C52AB6864C6DAA39571D8E52F0FE43476274710C3CF2365C2291F227C1BBBE399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl86t.dll
Size 1.8MB
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf
SSDEEP 24576:aNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBH9:aNgjid2LD5W4ac6xdLvIkhHP4ATdeD0
TLSH
T1A785AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl8\8.5\msgcat-1.6.1.tm
Size 34KB
SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
MD5 bd4ff2a1f742d9e6e699eeee5e678ad1
SHA1 811ad83aff80131ba73abc546c6bd78453bf3eb9
SHA512 b77e4a68017ba57c06876b21b8110c636f9ba1dd0ba9d7a0c50096f3f6391508cf3562dd94aceaf673113dbd336109da958044aefac0afb0f833a652e4438f43
SSDEEP 768:m3xQvCzasI/rHPG2yfkZ0Kbh91iQ3Lnq5MIVYB8mbgijsPIWtw4qvUm:4xQvCzasIDHPG2yW0kJ32imXmUij6JjG
TLSH
T1EEF2D624334741AB36B2526799B9A2A4CE3CE23F10AB959FB89A801C7731F5D43F74D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\auto.tcl
Size 21KB
SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
MD5 08edf746b4a088cb4185c165177bd604
SHA1 395cda114f23e513eef4618da39bb86d034124bf
SHA512 c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b
SSDEEP 384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
TLSH
T199A2C7635F9542A630B1C22B553DB9A4EF2F81B70675801D38FC912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\http1.0\pkgIndex.tcl
Size 746B
SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
MD5 a387908e2fe9d84704c2e47a7f6e9bc5
SHA1 f3c08b3540033a54a59cb3b207e351303c9e29c6
SHA512 7ac804d23e72e40e7b5532332b4a8d8446c6447bb79b4fe32402b13836079d348998ea0659802ab0065896d4f3c06f5866c6b0d90bf448f53e803d8c243bbc63
TLSH
T1720110C7AEF563A02C318B82364BE791DF1DE218F37256FA7450541C80A3866AB4A934
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\init.tcl
Size 25KB
SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
MD5 982eae7a49263817d83f744ffcd00c0e
SHA1 81723dfea5576a0916abeff639debe04ce1d2c83
SHA512 31370d8390c4608e7a727eed9ee7f4c568ecb913ae50184b6f105da9c030f3b9f4b5f17968d8975b2f60df1b0c5e278512e74267c935fe4ec28f689ac6a97129
SSDEEP 768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
TLSH
T1C3B2A7112384917932B343368AB9B598ED7EC1F715AD41BCB8CC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\opt0.4\pkgIndex.tcl
Size 620B
SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
MD5 07532085501876dcc6882567e014944c
SHA1 6bc7a122429373eb8f039b413ad81c408a96cb80
SHA512 0d604e862f3a1a19833ead99aaf15a9f142178029ab64c71d193cee4901a0196c1eeddc2bce715b7fa958ac45c194e63c77a71e4be4f9aedfd5b44cf2a726e76
TLSH
T1A4F00CA6AFE183A468A18CC33584F751AF2EF078726010F63414E49CE2A00A65F8F8B0
MD5 SHA1 SHA512 TLSH

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\package.tcl
Size 23KB
SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
MD5 ddb0ab9842b64114138a8c83c4322027
SHA1 eccacdc2ccd86a452b21f3cf0933fd41125de790
SHA512 c0cf718258b4d59675c088551060b34ce2bc8638958722583ac2313dc354223bfef793b02f1316e522a14c7ba9bed219531d505de94dc3c417fc99d216a01463
SSDEEP 384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
TLSH
T174B2C9217389925A34B153639B352C8CCF3EC0FB51A951BC78D882BC77709190ADEBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\tclIndex
Size 5KB
SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
MD5 c62fb22f4c9a3eff286c18421397aaf4
SHA1 4a49b8768cff68f2effaf21264343b7c632a51b2
SHA512 558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185
SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
TLSH
T14FC1301AA756C72803F481074999FE283ADED1E4D33DC93E99A491CD10B30076FEE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tcl\tm.tcl
Size 11KB
SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
MD5 215262a286e7f0a14f22db1aa7875f05
SHA1 66b942ba6d3120ef8d5840fcdeb06242a47491ff
SHA512 6ecd745d7da9d826240c0ab59023c703c94b158ae48c1410faa961a8edb512976a4f15ae8def099b58719adf0d2a9c37e6f29f54d39c1ab7ee81fa333a60f39b
SSDEEP 192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
TLSH
T1EC42B512B38A536A62B313254EBAF294DB2DD1FE57E5506C744D81A837208284B7F7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk86t.dll
Size 1.5MB
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9
SSDEEP 24576:C1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOJ0wd98ydeyRP/ecr:CIyQD9FU43GLUKuPO6EinYTVAFSvESKI
TLSH
T178655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\button.tcl
Size 21KB
SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
MD5 aeb53f7f1506cdfdfe557f54a76060ce
SHA1 ebb3666ee444b91a0d335da19c8333f73b71933b
SHA512 acdad4df988df6b2290fc9622e8eaccc31787fecdc98dcca38519cb762339d4d3fb344ae504b8c7918d6f414f4ad05d15e828df7f7f68f363bec54b11c9b7c43
SSDEEP 384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
TLSH
T19DA2CED1CA01437667738226957FA260EF5050FA86AB5418B45E80FC3FFF86A466E3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\entry.tcl
Size 17KB
SHA256 af1de90270693273b52fc735da6b5cd5ca794f5afd4cf03ffd95147161098048
MD5 f109865c52d1fd602e2d53e559e56c22
SHA1 5884a3bb701c27ba1bf35c6add7852e84d73d81f
SHA512 b2f92b0ac03351cdb785d3f7ef107b61252398540b5f05f0cc9802b4d28b882ba6795601a68e88d3abc53f216b38f07fcc03660ab6404cf6685f6d80cc4357fc
SSDEEP 384:mDfyRIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnkKYNlPp64ZnCD:mDfyRIlBk3yJ8mtpaplcp6o
TLSH
T15A8231D62D05577562B7C373E3BBF600EE36907726934026759693A02FB6022036EFDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\icons.tcl
Size 10KB
SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
MD5 995a0a8f7d0861c268aead5fc95a42ea
SHA1 21e121cf85e1c4984454237a646e58ec3c725a72
SHA512 db7f5e0bc7d5c5f750e396e645f50a3e0cde61c9e687add0a40d0c1aa304ddfbceeb9f33ad201560c6e2b051f2eded07b41c43d00f14ee435cdeee73b56b93c7
SSDEEP 192:0nEPytJLl1S47T3YqN5/vkJpnhXqBB4aw2rqZiygTtYTpOq/pc75Mk:xqLz7F5KTqBBLuZ1gTSsqhk
TLSH
T182329E33554065820BF7CDED7B9BE289FD5004AB260D2885B48A832A7FB5550EF317A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

listbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\listbox.tcl
Size 14KB
SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
MD5 804e6dce549b2e541986c0ce9e75e2d1
SHA1 c44ee09421f127cf7f4070a9508f22709d06d043
SHA512 029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b
SSDEEP 384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
TLSH
T1246242C42C34637171FFD22746FABB81FF6990A70595504438ACD0A4BF758B246ADACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

menu.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\menu.tcl
Size 38KB
SHA256 d1283f67e435aab0bdbe9fdaa540a162043f8d652c02fe79f3843a451f123d89
MD5 078782cd05209012a84817ac6ef11450
SHA1 dba04f7a6cf34c54a961f25e024b6a772c2b751d
SHA512 79a031f7732aee6e284cd41991049f1bb715233e011562061cd3405e5988197f6a7fb5c2bbddd1fb9b7024047f6003a2bf161fc0ec04876eff5335c3710d9562
SSDEEP 768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
TLSH
T1530396906F09E3375233D3A583BB9094FF3A82F31346609C745592AC37B58260AFEAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

panedwindow.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\panedwindow.tcl
Size 5KB
SHA256 aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9
MD5 286c01a1b12261bc47f5659fd1627abd
SHA1 4ca36795cab6dfe0bbba30bb88a2ab71a0896642
SHA512 d54d5a89b7408a9724a1ca1387f6473bdad33885194b2ec5a524c7853a297fd65ce2a57f571c51db718f6a00dce845de8cf5f51698f926e54ed72cdc81bcfe54
SSDEEP 96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
TLSH
T139B137F6D34895AA7071530552BFF39AC672B07B515F81283806C0A03FB698BE7B57E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\pkgIndex.tcl
Size 376B
SHA256 3f2539e85e2a9017913e61fe2600b499315e1a6f249a4ff90e0b530a1eeb8898
MD5 3367ce12a4ba9baaf7c5127d7412aa6a
SHA1 865c775bb8f56c3c5dfc8c71bfaf9ef58386161d
SHA512 f5d858f17fe358762e8fdbbf3d78108dba49be5c5ed84b964143c0adce76c140d904cd353646ec0831ff57cd0a0af864d1833f3946a235725fff7a45c96872eb
TLSH
T149E068880321AB1A4AA26543A890EE4C3FEE90BFE94CC19E301521DCEF12080ADDD8F5
MD5 SHA1 SHA512 TLSH

Submit Download

scale.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\scale.tcl
Size 7KB
SHA256 0da2dc955ffd71062a21c3b747d9d59d66a5b09a907b9ed220be1b2342205a05
MD5 857add6060a986063b0ed594f6b0cd26
SHA1 b1981d33ddea81cfffa838e5ac80e592d9062e43
SHA512 7d9829565efc8cdbf9249913da95b02d8dadfdb3f455fd3c10c5952b5454fe6e54d95c07c94c1e0d7568c9742caa56182b3656e234452aec555f0fcb76a59fb1
SSDEEP 96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQz9MUKOC9dLrVx:KsbYQO48t+QYa+NkFjpaQz5KX9dLrVx
TLSH
T149F161D16E82A22D9133C27A52A6D580FD55B0F31A875C48785A40E93FFE87542FEFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\tk\tk.tcl
Size 23KB
SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
MD5 338184e46bd23e508daedbb11a4f0950
SHA1 437db31d487c352472212e8791c8252a1412cb0e
SHA512 8fb8a353eecd0d19638943f0a9068dccebf3fb66d495ea845a99a89229d61a77c85b530f597fd214411202055c1faa9229b6571c591c9f4630490e1eb30b9cd3
SSDEEP 384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
TLSH
T1DEB2D7195DC062B3513BC13F53BB2A00E87558FB2776644978DC48B92F6883B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5004_894115_Ph8KC1hEQVc\unicodedata.pyd
Size 1.1MB
SHA256 3a0987025f1cf2111dc6e4f59402073ba123d7436d809ee4198b4e7bfb8cb868
MD5 3ba2a20dda6d1b4670767455bbe32870
SHA1 7c98221bc6ed763030087b1f33fb83eac2823ea4
SHA512 0688f8af3359a8571bef2a89efabc2dbf26f3f5c6220932a4e7df2e33fac95cafee8b80796346ba698e6bf43630b8069f56538b95a8ff62ec21d629787ca5cd1
SSDEEP 12288:SeqMmuZ63NBQCb5Pfhnzr0ql8L8kQM7IRG5eeme6VZyrIBHdQLhfFE+uJ7X+:SequaZV0m84MMREtV6Vo4uYJ7X+
TLSH
T1F2355909BAC24EE6E89B067940D3117B2F61C1720F0B6B4F76A5532D9C763A34EE653C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download