4a73d51f6bc3753dff10f89e30608af9fabc204aa82dfa99fc06b43a5d61c81c

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
Size 6.1MB
Sample261107-xbf6jsfh35
SHA256 4a73d51f6bc3753dff10f89e30608af9fabc204aa82dfa99fc06b43a5d61c81c
MD5 f72028fb03a0f5c11d9af7dedbaa64ee
SHA1 5584c570286dc93cf26704542e4041183986c30f
SHA512 e36e61043cedc0b4901f44ed53c002c0beef3360c3d6841f9fc597fa039682b77f6fd6aa6e237ad014632c6df5135efe5a59d51e7f749fcf74401e3e96799cf5
SSDEEP 196608:4lejKWdshEVSL2v8hpTRhOvCYIeSDsSsPuLk:YejB+aVSLo8plPHs2
TLSH
T188562381E29009E1CD6A5B76AE32CC3295337CAE5634D49E26DC3E633FFB7925439601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4888	Process not Found
5256	Process not Found
5940	Process not Found
6608	Process not Found
8892	Process not Found
9528	Process not Found
10948	Process not Found
4044	attrib.exe
3292	attrib.exe
6616	Process not Found
9968	Process not Found
9236	Process not Found
4888	attrib.exe
5532	Process not Found
10916	Process not Found
3088	attrib.exe
5220	Process not Found
7448	Process not Found
4928	Process not Found
8588	Process not Found
11096	Process not Found
11236	Process not Found
11928	Process not Found
4128	attrib.exe
8184	Process not Found
11964	Process not Found
4248	Process not Found
12692	Process not Found
3608	Process not Found
6972	Process not Found
8996	Process not Found
10672	Process not Found
11288	Process not Found
4652	Process not Found
4460	Process not Found
11732	Process not Found
11628	Process not Found
404	Process not Found
8092	Process not Found
9108	Process not Found
9648	Process not Found
2304	attrib.exe
6232	Process not Found
8	attrib.exe
3660	attrib.exe
8288	Process not Found
11188	Process not Found
5728	Process not Found
8196	Process not Found
9992	Process not Found
10000	Process not Found
7640	Process not Found
2628	Process not Found
8504	Process not Found
11172	Process not Found
12024	Process not Found
11472	Process not Found
11964	Process not Found
5420	Process not Found
9048	Process not Found
10052	Process not Found
11236	Process not Found
11664	Process not Found
6452	Process not Found

Loads dropped DLL 7 IoCs

pid	Process
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5428	Process not Found
8108	Process not Found
8488	Process not Found
8956	Process not Found
10684	Process not Found
2788	cmd.exe
2432	Process not Found
5492	Process not Found
6180	Process not Found
8188	Process not Found
8772	Process not Found
9900	Process not Found
9552	Process not Found
3780	cmd.exe
2920	cmd.exe
6044	Process not Found
6992	Process not Found
1712	Process not Found
7872	Process not Found
8744	Process not Found
10904	Process not Found
8444	Process not Found
8924	Process not Found
10996	Process not Found
11076	Process not Found
11224	Process not Found
11340	Process not Found
4232	cmd.exe
4944	cmd.exe
2820	cmd.exe
6200	Process not Found
11860	Process not Found
11820	Process not Found
11744	Process not Found
3340	cmd.exe
4056	cmd.exe
2976	cmd.exe
3068	Process not Found
9792	Process not Found
9784	Process not Found
4616	cmd.exe
7376	Process not Found
8884	Process not Found
9732	Process not Found
4460	Process not Found
7932	Process not Found
9568	Process not Found
9580	Process not Found
7180	Process not Found
7432	Process not Found
11744	Process not Found
2428	cmd.exe
6684	Process not Found
6640	Process not Found
9876	Process not Found
11752	Process not Found
3100	Process not Found
7060	Process not Found
7736	Process not Found
8752	Process not Found
9676	Process not Found
11228	Process not Found
12184	Process not Found
7664	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1876	5048	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	85
PID 1876 wrote to memory of 3040	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	86
PID 1876 wrote to memory of 3684	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	87
PID 1876 wrote to memory of 3340	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	88
PID 1876 wrote to memory of 2808	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	89
PID 1876 wrote to memory of 4400	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	90
PID 1876 wrote to memory of 4172	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	91
PID 4172 wrote to memory of 4980	4172	cmd.exe	92
PID 1876 wrote to memory of 4300	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	93
PID 4300 wrote to memory of 940	4300	cmd.exe	94
PID 1876 wrote to memory of 2088	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	95
PID 2088 wrote to memory of 3432	2088	cmd.exe	96
PID 1876 wrote to memory of 2208	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	97
PID 2208 wrote to memory of 4424	2208	cmd.exe	98
PID 1876 wrote to memory of 4500	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	99
PID 1876 wrote to memory of 4232	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	100
PID 1876 wrote to memory of 4060	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	101
PID 1876 wrote to memory of 2116	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	102
PID 1876 wrote to memory of 3792	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	103
PID 1876 wrote to memory of 3372	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	104
PID 3372 wrote to memory of 3152	3372	cmd.exe	105
PID 1876 wrote to memory of 2752	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	106
PID 2752 wrote to memory of 2780	2752	cmd.exe	107
PID 1876 wrote to memory of 4552	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	108
PID 4552 wrote to memory of 2476	4552	cmd.exe	109
PID 1876 wrote to memory of 3064	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	110
PID 3064 wrote to memory of 2784	3064	cmd.exe	111
PID 1876 wrote to memory of 548	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	112
PID 1876 wrote to memory of 5004	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	113
PID 1876 wrote to memory of 3492	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	114
PID 1876 wrote to memory of 4032	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	115
PID 1876 wrote to memory of 3244	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	116
PID 1876 wrote to memory of 2440	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	117
PID 2440 wrote to memory of 2564	2440	cmd.exe	118
PID 1876 wrote to memory of 4352	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	119
PID 4352 wrote to memory of 1448	4352	cmd.exe	120
PID 1876 wrote to memory of 4428	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	121
PID 4428 wrote to memory of 960	4428	cmd.exe	122
PID 1876 wrote to memory of 3080	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	123
PID 3080 wrote to memory of 4892	3080	cmd.exe	124
PID 1876 wrote to memory of 2928	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	125
PID 1876 wrote to memory of 4084	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	126
PID 1876 wrote to memory of 2484	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	127
PID 1876 wrote to memory of 2132	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	128
PID 1876 wrote to memory of 1664	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	129
PID 1876 wrote to memory of 4040	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	130
PID 4040 wrote to memory of 4044	4040	cmd.exe	131
PID 1876 wrote to memory of 1132	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	132
PID 1132 wrote to memory of 464	1132	cmd.exe	133
PID 1876 wrote to memory of 4832	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	134
PID 4832 wrote to memory of 4776	4832	cmd.exe	135
PID 1876 wrote to memory of 3968	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	136
PID 3968 wrote to memory of 396	3968	cmd.exe	137
PID 1876 wrote to memory of 3708	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	138
PID 1876 wrote to memory of 3320	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	139
PID 1876 wrote to memory of 3948	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	140
PID 1876 wrote to memory of 452	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	141
PID 1876 wrote to memory of 3540	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	142
PID 1876 wrote to memory of 2856	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	143
PID 2856 wrote to memory of 3292	2856	cmd.exe	144
PID 1876 wrote to memory of 1264	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	145
PID 1264 wrote to memory of 4564	1264	cmd.exe	146
PID 1876 wrote to memory of 4228	1876	2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe	147
PID 4228 wrote to memory of 3500	4228	cmd.exe	148

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
396	attrib.exe
6388	Process not Found
9092	Process not Found
10404	Process not Found
5212	Process not Found
6540	Process not Found
7236	Process not Found
8420	Process not Found
10144	Process not Found
9252	Process not Found
5940	Process not Found
7784	Process not Found
6076	Process not Found
6096	Process not Found
404	Process not Found
2564	attrib.exe
3068	Process not Found
2956	attrib.exe
5940	Process not Found
8472	Process not Found
9408	Process not Found
4392	attrib.exe
5672	Process not Found
9212	Process not Found
9004	Process not Found
6304	Process not Found
10048	Process not Found
4584	attrib.exe
5784	Process not Found
7252	Process not Found
5784	Process not Found
1900	Process not Found
11224	Process not Found
12064	Process not Found
4260	Process not Found
1716	Process not Found
7872	Process not Found
10124	Process not Found
12628	Process not Found
4324	attrib.exe
8796	Process not Found
9980	Process not Found
11976	Process not Found
4112	attrib.exe
7776	Process not Found
2436	Process not Found
7424	Process not Found
8508	Process not Found
9652	Process not Found
9688	Process not Found
6388	Process not Found
10432	Process not Found
3292	attrib.exe
4852	attrib.exe
5152	Process not Found
6888	Process not Found
9416	Process not Found
9884	Process not Found
11964	Process not Found
9072	Process not Found
8500	Process not Found
11432	Process not Found
12020	Process not Found
3828	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-06_f72028fb03a0f5c11d9af7dedbaa64ee_glassworm_icedid_njrat_ryuk.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe C:\
    3⤵
    PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk C:\
    3⤵
    - Executes a command shell one-liner
    PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe C:\
    3⤵
    PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe C:\
    3⤵
    PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk C:\
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h C:\twm.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\twm.exe
      4⤵
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h C:\twm_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\twm_.lnk
      4⤵
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h C:\task_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\task_.lnk
      4⤵
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h C:\task.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\task.exe
      4⤵
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Sets file to hidden
      PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      Views/modifies file attributes
      PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Views/modifies file attributes
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:5084
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    - Executes a command shell one-liner
    PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2124
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4752
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:768
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:68
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3560
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Views/modifies file attributes
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:956
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3240
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:920
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1172
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3648
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4348
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1624
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3040
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4548
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1988
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4772
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4544
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2508
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2880
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4068
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1968
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3392
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3668
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:216
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1784
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4084
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2132
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1048
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4816
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1068
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3320
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:452
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2792
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4660
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1196
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4488
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1868
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Sets file to hidden
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2336
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4292
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2520
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2832
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1384
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4828
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    - Executes a command shell one-liner
    PID:3340
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    - Executes a command shell one-liner
    PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4580
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4540
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4204
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3496
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4924
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:772
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4592
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3836
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3008
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1404
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1636
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4044
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3116
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4640
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3540
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4564
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3024
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4696
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:912
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4556
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2424
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1804
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3920
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3972
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2372
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:944
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4136
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3868
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3504
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4516
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2780
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2476
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    - Executes a command shell one-liner
    PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2692
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4904
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2812
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2364
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1012
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4732
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3524
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3820
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    - Executes a command shell one-liner
    PID:2920
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2000
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:5024
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3676
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1956
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Sets file to hidden
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2868
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1244
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3140
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2452
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4896
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4480
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3772
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    - Executes a command shell one-liner
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:5092
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4176
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1960
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4000
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:960
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Sets file to hidden
      PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4744
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:860
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1664
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3120
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:552
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2652
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2952
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3604
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      Views/modifies file attributes
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2548
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3360
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4184
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    - Executes a command shell one-liner
    PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4268
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1032
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    - Executes a command shell one-liner
    PID:2820
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2808
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4424
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4232
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4644
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:5116
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:5052
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1680
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      Views/modifies file attributes
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1708
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4576
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1760
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1548
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1744
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4612
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2612
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2164
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2988
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1672
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4520
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3896
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4328
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1780
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4372
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4444
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:208
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      Views/modifies file attributes
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4884
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2928
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2540
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:756
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3272
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2516
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3744
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4764
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2788
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1408
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:940
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4980
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2852
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3084
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4368
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1536
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:5036
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4344
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4028
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3708
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1392
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4788
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3252
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:5056
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4240
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3784
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1908
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1252
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:688
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3216
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4584
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1268
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2168
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1920
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4020
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4956
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4308
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2148
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4472
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3484
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2532
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      Views/modifies file attributes
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4100
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:456
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:5004
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1160
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:8
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:5096
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4776
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:468
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2176
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4392
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1984
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      Sets file to hidden
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3112
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4312
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4792
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4500
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1660
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    - Executes a command shell one-liner
    PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3492
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3424
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:464
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3912
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2984
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4180
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4808
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2844
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1732
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3684
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1240
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3432
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:948
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:212
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1448
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3824
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1596
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2276
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:412
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:416
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3712
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1016
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3516
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2192
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1232
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:5020
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4476
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      Sets file to hidden
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2936
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2292
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2428
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4932
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3816
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4400
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3780
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      Views/modifies file attributes
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:684
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1992
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1684
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:5060
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3256
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3800
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:908
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4880
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4900
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3564
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4388
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3828
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4740
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      Views/modifies file attributes
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1816
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2024
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4464
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:764
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      Views/modifies file attributes
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3184
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:532
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1076
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3860
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4064
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3380
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4356
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2956
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:744
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4420
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4852
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1800
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2784
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2864
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2080
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:220
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4936
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:3932
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4780
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:4616
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4056
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    - Executes a command shell one-liner
    PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1352
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:1844
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3308
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      Sets file to hidden
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:3928
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:800
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4892
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1696
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2484
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      Sets file to hidden
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:4200
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:4224
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:3936
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:2836
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2564
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3108
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:2064
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4948
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1796
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2284
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1248
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:1560
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:2216
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:3284
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm_.lnk
      4⤵
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task_.lnk
    3⤵
    PID:1436
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task_.lnk
      4⤵
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\task.exe
    3⤵
    PID:4252
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\task.exe
      4⤵
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm.exe F:\
    3⤵
    PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy twm_.lnk F:\
    3⤵
    PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy resume.exe F:\
    3⤵
    PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task.exe F:\
    3⤵
    PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy task_.lnk F:\
    3⤵
    PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm.exe
    3⤵
    PID:1368
  - - C:\Windows\system32\attrib.exe
      attrib +s +h F:\twm.exe
      4⤵
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h F:\twm_.lnk
    3⤵
    PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\2.exe.manifest
Size 1009B
SHA256 19b28019f04a9afbe509923d66d560fe6cae615ada3441211c2f8234cd156735
MD5 ebd77f19c10938fd0a13c344a252f5ac
SHA1 430046093fbbcbc7a3eafdd7cfede6e668cea905
SHA512 b43236fe7de28a5ea7cf4155eb3331bc7f0f0a5eecd5b844b9c131bfdb2cffb44b6aa785a628aa9fe6b0b4b01cc885e01dee7ee8b2986564883475a69cfb093f
TLSH
T1CC11E100C4C8D862F73205D33360AD49DE59A7BB488C469DB48D7B6F4B13ED48253168
MD5 SHA1 SHA512 TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_ctypes.pyd
Size 119KB
SHA256 6f450435edb2b78504f166044aa45e87cd19670789dfacdb1074db7f934ab2a6
MD5 77be51b28c575526d749e2a91f3a4a83
SHA1 6a3a1b24696f5e82813eb5ae633fb4a3543d0543
SHA512 2fb131ed48ac08e51c485d8ce5f16c09c7aa7d3ababb02b01198cc5ece15c33f161af25b7ed3130ee63676dedc0ffb06c40eeb2a6c8654d89ba3539a5242cf6a
SSDEEP 3072:GlBQfrPbtfynx+PRNn5LrL3BL8V4V5+4fJMThn6l:3DDtfIx+PRB5LrLRLK4ffJMTVm
TLSH
T170C3194A23641188EBF6917CC8219E62DB723469170143CF4664C7AA2F93AD77DBE7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_hashlib.pyd
Size 1.6MB
SHA256 4c5af12ecd203ea45e2aec5ce9b4b862636a3b9a6057ce0d5d8cce0ee37ec3a9
MD5 ae415df4a7c5e23857092c0c10bd7d8f
SHA1 ee6793e2eebb0e11e520933f4d233d8818d7c066
SHA512 6d1666e387eba3a1e12d98d971f58adbd05d8d7fa5b4ed5240fbe0343c342ad36d4547d705b84acbae66d2a6013bb4484fd33bf74567ff81420297cbdc6677ac
SSDEEP 49152:iPZZq9jSQ5k2wbmSNPGtlqZVwASO+QPpyo3sALbF+:iPij5KwP
TLSH
T146758D1AE1A401D5D9BBC238C967463BE3F1B4081B70ABDF46A2DB992F13BD5523E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll
Size 3.3MB
SHA256 733f502cd8ab9ecfa9f54af7f623fd5023a4702990af6985bb4c9028e9eb994f
MD5 bc5dd2f6e46535812a6b1eba966584fc
SHA1 bb8da5fed602383aef64e73ac1700ff645b1b188
SHA512 d0252489f0af85cd775a9bbec470380d19ee80bf672dc538cabbb7f548deb63d71518f37932f84acff3a41b596c60cac65d87cb9ccabf7f5956b494a903332bf
SSDEEP 49152:CnHmMWTjmrbx/NWSRCgn6S4Ttffg7d47fPjnRM4gHQM1IITPCc+y5+3jt:nsVZzWzRMhHnaup5mt
TLSH
T106F58D46A36720A8DBB7C878CD069642D3717C742B2973CB4564B7AA6B33DE3067E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\pythoncom27.dll
Size 537KB
SHA256 c9f1b53f87a4ee5d4740e03c9da300166de8c239be726e42f2d9d96bd81fabe2
MD5 7805e430a83c985a059fbb9df16da10c
SHA1 498b077aa47b53667937dc2b8463f8ff169dcb08
SHA512 fba45917ddd07505b0035eeaf1fb6d8d472473dbcd2710cb8388bcbbf7833e65e1eb53b05e919c59ee5e11051068dabb65eb4e8b2262c3bcf8b74aa74fdd30ae
SSDEEP 12288:pwrL4cJFXu+DcEEwyAoojDGeCbU7TIOrIvpXgNNoQYyzQ+BSpSq1MNIYYeyIsG+T:pwrL4cJFXu+YEpyAoojaeCbU7TIOrIvo
TLSH
T19AC45C56BB5F5D82E337A23E88435B02D1B27460179DB7C705B5C3AA1B23ED72A3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\pywintypes27.dll
Size 135KB
SHA256 959bece25a592bf32d3b3e602bb8ebe88039db2f58916f593db3b66795258074
MD5 ec16db0ad80be2fb40600df034797ecb
SHA1 6d5bce3b8fb8c7dff0aa179d503af47887e3f0c2
SHA512 e0827664a6ff06093c16b520da354af77d85ee10a364fd827ecd345d61c322005104354c12cee9778560e44e6ae7a4aa7e4070f388ef8799f139ea8c5c0c97fb
SSDEEP 3072:gMwiYgZWoh2lw41fwYYrrC0zrG+h+lu01dOlHqmvfbhc:BwiYSPlCfwYYrrC0XG+Ku2dOlHqmvfb
TLSH
T181D33A42375384D9DA76D37DCDA50B02D2B174200B09F3DF06A5C2925EB3BE6AD3B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50~1\bz2.pyd
Size 90KB
SHA256 baa75ad550784c5c5bada51cb565784a04f267fad708e6611b0cc3dc6ae0c1ed
MD5 a1950d15ae7fadd5b203639f3965f690
SHA1 dd09dfee5577feca2ce25d9cc5091933ca580adb
SHA512 b0ca2e27e0fa77a58c7a56d66bf01fca152cb784e11ced7e247b092864f5a81b6cde353adfe58193d660f9be7b37c8076a6ca75390d4b34228b5359a3a884c88
SSDEEP 1536:+2swYRURXPj3/W3yd/nVu26F3RjrEOxZhuhiDOouhvqucpY62M84+f/PPgTt/:ewYRUR7/W3yd/npS3BE8uhiDObvquWY0
TLSH
T1CA937D41A5816EEEC533C2F4D616952BE73A78A803415BEF8230E9292F43DE27D7C6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50~1\win32api.pyd
Size 127KB
SHA256 db7ab701c7626b928bb4306bc49cc5f55cff56dacea7cfdccc77eefd06fb136a
MD5 ee73b5435ffd8c1ed67525263b35d4d1
SHA1 3a1ddf1aa147f5c5f165209ad388bb02fc55fb8d
SHA512 70372c9f627be9b42a24dac36af96d1483a7f8c91c0e9ebde80a8168bed7ba14b23d55d330a3f6fd3609190bf5bde98267a2a87abfd414be77a4384f331f4c39
SSDEEP 3072:wfpPfw3tz9JkJLl2j+ahLaBBoX9GsfIiM2p6hoWFdLwx:wfpPfw3fuFl2CZsfIiMZoUdL
TLSH
T1C0D30883639750C9D87AA7BCC57457229B7278640318B3DF4AA0C5470F63AEA7E3CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

twm_.lnk

Path C:\twm_.lnk
Size 1KB
SHA256 b3579e2954d12b9fcde3dd9cb2efe871fbcad2789ef4bf1283f248c2ea8d0570
MD5 aaf9465c79adc5ebeb9c06bc118828c3
SHA1 806e9cf84327465c5a390161696018e9a39601a6
SHA512 77ee181200be61e9aa90e8925a5abbdfcf6a515741a3d979d23f9ee66e8aad161dd72876e11166ec68c0021cf5b8219440c4b772a951dfea758cc5a3adeb0631
TLSH
T170218C191CCA5B61D3B18CF210B6E3314BFA7C95EE9BA38C00485ACC606A134F179D63
MD5 SHA1 SHA512 TLSH

Submit Download

task_.lnk

Path F:\task_.lnk
Size 1KB
SHA256 5b7e3d26204fc0608c759c9c37acb7567a236806f08d7bbc5eb243c7d31e8c66
MD5 82a2c33c43862dbc594e8ad0102fee1a
SHA1 f3ff2165392bb7eb28caa189be173de1f908b42b
SHA512 959ff4c4152bb995802294123ade32a4ff8353d9162c134e44306ce12ba339192309a39fbdc529634b6a76e481d6abd02c400169dd68e330b05642a88c40383f
TLSH
T166218C490CCA5B26D3728DB220F693304AF63D42FD9AA31C404C9ACD617F190F1B9D6B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads