bfd4c2690b113c10b2c7a800c68927f7f81383f0697e2578b8545fecd16ebe92

Analysis

user interaction
yes
max time kernel
38s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ST_Internal_Loader.exe
Size 17.9MB
Sample260808-fm311styct
SHA256 bfd4c2690b113c10b2c7a800c68927f7f81383f0697e2578b8545fecd16ebe92
MD5 ce7bc571536d5c53d4bb2caa14f5c5bd
SHA1 6e3c38d1bf7b1da6e053df23e1ecca3471bcaaf9
SHA512 c5e8353fc10ed6c2a4e164c20fd44f29fd826d44e811ff0e6b5983fb7e3a4c22ff68787a760d91c2bd7ab573fa6f8d068617cecb12a2fbeed9f0d3e4b216b1d3
SSDEEP 393216:v9AdNyz71BQbhpixqgfRLghRckzwlgUciGPeXNX4wDvJ1V4n1y:ICEXixnfR0YkzkImSwDvJT4n1y
TLSH
T1251733D35E35BF4EDFCF983A3D91E24EA34DCACD0D06B6148845A7AC43854AB66BC064
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ST_Internal_Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ST_Internal_Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ST_Internal_Loader.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ST_Internal_Loader.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ST_Internal_Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4644	cmd.exe
1724	cmd.exe
4068	cmd.exe
4600	cmd.exe
2480	cmd.exe
4592	cmd.exe
2676	cmd.exe
3112	cmd.exe
236	cmd.exe
324	cmd.exe
2440	cmd.exe
2152	cmd.exe
1340	cmd.exe
1796	cmd.exe
3356	cmd.exe
3284	cmd.exe
4056	cmd.exe
1488	cmd.exe
3080	cmd.exe
3720	cmd.exe
1804	cmd.exe
1112	cmd.exe
4736	cmd.exe
5112	cmd.exe
2540	cmd.exe
2200	cmd.exe
1528	cmd.exe
4752	cmd.exe
4588	cmd.exe
1664	cmd.exe
1340	cmd.exe
4068	cmd.exe
5104	cmd.exe
3680	cmd.exe
1564	cmd.exe
3260	cmd.exe
3376	cmd.exe
3424	cmd.exe
2452	cmd.exe
3844	cmd.exe
3988	cmd.exe
2912	cmd.exe
1992	cmd.exe
3920	cmd.exe
2988	cmd.exe
4180	cmd.exe
3556	cmd.exe
3376	cmd.exe
1632	cmd.exe
680	cmd.exe
4692	cmd.exe
5080	cmd.exe
952	cmd.exe
2944	cmd.exe
1872	cmd.exe
5080	cmd.exe
3384	cmd.exe
2576	cmd.exe
1872	cmd.exe
1048	cmd.exe
1876	cmd.exe
4592	cmd.exe
2128	cmd.exe
1036	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe
1572	ST_Internal_Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2440	1572	ST_Internal_Loader.exe	82
PID 1572 wrote to memory of 2816	1572	ST_Internal_Loader.exe	83
PID 1572 wrote to memory of 2016	1572	ST_Internal_Loader.exe	84
PID 1572 wrote to memory of 2872	1572	ST_Internal_Loader.exe	86
PID 1572 wrote to memory of 1036	1572	ST_Internal_Loader.exe	88
PID 1572 wrote to memory of 3044	1572	ST_Internal_Loader.exe	90
PID 1572 wrote to memory of 2452	1572	ST_Internal_Loader.exe	92
PID 1572 wrote to memory of 1292	1572	ST_Internal_Loader.exe	94
PID 1572 wrote to memory of 988	1572	ST_Internal_Loader.exe	96
PID 1572 wrote to memory of 3844	1572	ST_Internal_Loader.exe	98
PID 1572 wrote to memory of 2676	1572	ST_Internal_Loader.exe	100
PID 1572 wrote to memory of 892	1572	ST_Internal_Loader.exe	102
PID 1572 wrote to memory of 2424	1572	ST_Internal_Loader.exe	104
PID 1572 wrote to memory of 604	1572	ST_Internal_Loader.exe	106
PID 1572 wrote to memory of 2948	1572	ST_Internal_Loader.exe	108
PID 1572 wrote to memory of 3080	1572	ST_Internal_Loader.exe	110
PID 1572 wrote to memory of 1616	1572	ST_Internal_Loader.exe	112
PID 1572 wrote to memory of 3112	1572	ST_Internal_Loader.exe	114
PID 1572 wrote to memory of 412	1572	ST_Internal_Loader.exe	116
PID 1572 wrote to memory of 1872	1572	ST_Internal_Loader.exe	118
PID 1572 wrote to memory of 2160	1572	ST_Internal_Loader.exe	120
PID 1572 wrote to memory of 764	1572	ST_Internal_Loader.exe	122
PID 1572 wrote to memory of 760	1572	ST_Internal_Loader.exe	124
PID 1572 wrote to memory of 3248	1572	ST_Internal_Loader.exe	126
PID 1572 wrote to memory of 236	1572	ST_Internal_Loader.exe	128
PID 1572 wrote to memory of 3720	1572	ST_Internal_Loader.exe	130
PID 1572 wrote to memory of 1708	1572	ST_Internal_Loader.exe	132
PID 1572 wrote to memory of 960	1572	ST_Internal_Loader.exe	134
PID 1572 wrote to memory of 4784	1572	ST_Internal_Loader.exe	136
PID 1572 wrote to memory of 1928	1572	ST_Internal_Loader.exe	138
PID 1572 wrote to memory of 4644	1572	ST_Internal_Loader.exe	140
PID 1572 wrote to memory of 3692	1572	ST_Internal_Loader.exe	142
PID 1572 wrote to memory of 4936	1572	ST_Internal_Loader.exe	144
PID 1572 wrote to memory of 3384	1572	ST_Internal_Loader.exe	146
PID 1572 wrote to memory of 324	1572	ST_Internal_Loader.exe	148
PID 1572 wrote to memory of 3988	1572	ST_Internal_Loader.exe	150
PID 1572 wrote to memory of 1268	1572	ST_Internal_Loader.exe	152
PID 1572 wrote to memory of 1184	1572	ST_Internal_Loader.exe	154
PID 1572 wrote to memory of 4040	1572	ST_Internal_Loader.exe	156
PID 1572 wrote to memory of 1804	1572	ST_Internal_Loader.exe	158
PID 1572 wrote to memory of 2152	1572	ST_Internal_Loader.exe	160
PID 1572 wrote to memory of 2576	1572	ST_Internal_Loader.exe	162
PID 1572 wrote to memory of 2472	1572	ST_Internal_Loader.exe	164
PID 1572 wrote to memory of 4612	1572	ST_Internal_Loader.exe	166
PID 1572 wrote to memory of 648	1572	ST_Internal_Loader.exe	168
PID 1572 wrote to memory of 1112	1572	ST_Internal_Loader.exe	170
PID 1572 wrote to memory of 4736	1572	ST_Internal_Loader.exe	172
PID 1572 wrote to memory of 1744	1572	ST_Internal_Loader.exe	174
PID 1572 wrote to memory of 1724	1572	ST_Internal_Loader.exe	176
PID 1572 wrote to memory of 2248	1572	ST_Internal_Loader.exe	178
PID 1572 wrote to memory of 2988	1572	ST_Internal_Loader.exe	180
PID 1572 wrote to memory of 3376	1572	ST_Internal_Loader.exe	182
PID 1572 wrote to memory of 1528	1572	ST_Internal_Loader.exe	184
PID 1572 wrote to memory of 3192	1572	ST_Internal_Loader.exe	186
PID 1572 wrote to memory of 4124	1572	ST_Internal_Loader.exe	188
PID 1572 wrote to memory of 892	1572	ST_Internal_Loader.exe	190
PID 1572 wrote to memory of 3288	1572	ST_Internal_Loader.exe	192
PID 1572 wrote to memory of 2912	1572	ST_Internal_Loader.exe	194
PID 1572 wrote to memory of 1992	1572	ST_Internal_Loader.exe	196
PID 1572 wrote to memory of 4700	1572	ST_Internal_Loader.exe	198
PID 1572 wrote to memory of 1860	1572	ST_Internal_Loader.exe	200
PID 1572 wrote to memory of 3112	1572	ST_Internal_Loader.exe	202
PID 1572 wrote to memory of 5112	1572	ST_Internal_Loader.exe	204
PID 1572 wrote to memory of 1872	1572	ST_Internal_Loader.exe	206

C:\Users\Admin\AppData\Local\Temp\ST_Internal_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\ST_Internal_Loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000140000000-0x0000000142C31000-memory.dmp

Download

memory/1572-2-0x0000000140000000-0x0000000142C31000-memory.dmp

Download

memory/1572-3-0x0000000140000000-0x0000000142C31000-memory.dmp

Download

memory/1572-4-0x0000000140000000-0x0000000142C31000-memory.dmp

Download

memory/1572-5-0x0000000140000000-0x0000000142C31000-memory.dmp

Download

memory/1572-6-0x0000000140000000-0x0000000142C31000-memory.dmp

Download

memory/1572-7-0x0000000140000000-0x0000000142C31000-memory.dmp

Download